feat: Key-Rotate command

[alex289]

Summary

• Add a new hub key rotate command to re-encrypt database fields from an old APP_SECRET to the current one.
• Cover agents, applications, repositories, notifications, and OIDC providers, with confirmation prompts and safe validation for secret length and equality.
• Surface a concise success summary after rotation and block execution in demo mode or when the database is unavailable.
• Add tests for rotation behavior, secret validation, and command wiring.

Testing

• Added unit tests covering successful re-encryption, invalid secret rejection, and CLI command registration.
• Not run (not requested).

Fixes #167

[codecov]

Codecov Report

❌ Patch coverage is 81.57895% with 49 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/cmd/hub/key_rotate.go	83.75%	21 Missing and 18 partials ⚠️
backend/internal/hub/crypto/crypto.go	65.00%	4 Missing and 3 partials ⚠️
backend/cmd/hub/main.go	50.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Adds a new Hub CLI surface for rotating the database encryption key (derived from APP_SECRET) by re-encrypting all encrypted DB fields using a provided previous secret, with confirmation prompts, demo-mode blocking, and unit tests to validate rotation behavior.

Changes:

• Register a new hub key command group with a rotate subcommand.
• Implement key rotation logic to re-encrypt encrypted fields across Agents, Applications, Repositories, Notifications, and OIDC providers within a DB transaction.
• Add unit tests covering successful re-encryption, invalid secret validation, and command wiring.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
backend/cmd/hub/main.go	Registers the new key command with the Hub CLI root command.
backend/cmd/hub/key_rotate.go	Implements hub key rotate, including secret validation, confirmation flow, DB connection, transactional re-encryption, and result rendering.
backend/cmd/hub/key_rotate_test.go	Adds tests for rotation correctness and secret validation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[timokoessler]

Cool