ops: write docs/operations/update-saml2-certificate.md

SAML IdP cert rotation procedure to parallel laddr's legacy doc.

Per [specs/api/saml.md](specs/api/saml.md#cert--key-rotation), the rotation steps are:

1. Generate new key + cert
2. Update Slack's admin UI with the new public cert
3. Update the API's SAML_PRIVATE_KEY / SAML_CERTIFICATE secrets
4. Restart the API

The doc should expand these into runnable commands (openssl invocation, Slack admin UI link, our secrets backend), and include the cadence (3 years). Surfaced by the saml-idp plan's closeout (PR #49) — the runbook step isn't owned by any other planned work.

Create docs/operations/update-saml2-certificate.md. Start with specs/api/saml.md#cert--key-rotation and inspect the repository for the API secrets backend and SAML settings; use PR #49 for context. Done means the runbook includes runnable openssl commands, the Slack admin UI link, secret-update steps, an API restart step, and the three-year rotation cadence.

Written by the indexing model from the issue text.