security: pk_/sk_ key rotation, origin-validation hardening, and CSP guidance for embedded widget

[diegocintron]

Closes #36

Summary

Implements #36 — key rotation with a grace period, hardened origin validation, and copy-paste CSP guidance for the embedded widget. Builds on the pk_/sk_ key model (#11) and the origin validation shipped in the first campaign.

Key rotation with grace period (services/connect-gateway)

• rotateApiKey now issues a new pk_/sk_ pair as a successor ApiKey (linked via rotatedFromId) instead of overwriting the secret in place. The old key stays active with a graceExpiresAt window (default 24h, configurable via KEY_ROTATION_GRACE_MS), so in-flight sessions using the old key keep working during cutover.
• cutoverApiKey + POST /admin/keys/:id/cutover revoke the predecessor on demand; keys also expire lazily once the grace window passes (no cron). Double-rotation is guarded.

Origin-validation hardening

• New normalizeOrigin (rejects non-http(s) schemes, embedded credentials, path/query/fragment, and unparseable values) and matchOrigin (single-label wildcard https://*.example.com; apex, multi-level, and bare * are rejected case-insensitively; protocol and port must match).
• Middleware now falls back to Referer when Origin is absent and returns explicit error codes: key_required, key_invalid, origin_required, invalid_origin, origin_not_allowed. allowedOrigins are validated at key-creation time too.

CSP + iframe-sandbox guidance (apps/docs, packages/connect-elements)

• New security.mdx with mode-aware, copy-paste CSP snippets (in-page mount() vs isolated mountFrame()) and iframe-sandbox guidance.
• FRAME_SANDBOX is exported as the single source of truth for the sandbox tokens; csp.test.ts asserts the built widget bundle contains no eval()/new Function()/inline <script> and that the documented sandbox string matches the constant.

Acceptance criteria

• Rotating a key does not break in-flight sessions using the old key during the grace period.
• A spoofed or malformed origin is rejected with a clear error code, with tests covering the edge cases.
• Docs site includes a copy-paste CSP snippet, verified against the actual widget bundle.

Testing

• Full suite green: 301 tests (core 67, react 16, elements 33, gateway 185).
• npm run type-check (8/8) and npm run check (biome) clean.

Follow-ups (non-blocking)

• Double-rotation guard runs outside the rotate transaction — a rare concurrent admin double-rotate would 500 (the DB unique constraint protects integrity); could be tightened to a 409.
• KEY_ROTATION_GRACE_MS uses Number.parseInt, which is lenient about trailing garbage ("24abc" → 24).

[aguilar1x]

LGTM!