curl --request POST \
  --url https://api.example.com/api/secrets/anon-key/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "gracePeriodHours": 168
}
'

{
  "success": true,
  "message": "Anon key rotated successfully. Old key will remain valid during grace period.",
  "anonKey": "anon_1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd",
  "oldKeyExpiresAt": "2026-06-18T00:00:00.000Z"
}