OpenFinance: rotate tenant webhook secret

Rotates the inbound webhook secret used by OpenFinance to deliver events. Optionally accepts a new `authorizationKey` and `baseUrl`. Verifies the new key with upstream before persisting; returns 502 when upstream rejects.

curl -X POST "https://example.com/v1/data-sources/openfinance/webhook/rotate" \  -H "Content-Type: application/json" \  -d '{}'

{  "ok": true}