fix(init): Add key rotation support to --force reinit

Previously, --force immediately overwrote private.pem before attempting
provider registration, making it impossible to create the rotation proof
(old-key signature of new public key) required by POST /auth/rotate-keys.
This left provider registrations permanently stale after a 409 conflict.

Now --force generates new keys to a temp directory first, creates the
proof using the old private key, rotates with each registered provider,
then swaps keys into place. Falls through to fresh registration if no
provider registrations exist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>