Add a method to rotate encryption password

ToolHive currently lacks any method to rotate/change the encryption password. Users must delete the keyring entry (with thv secret reset-keyring) and secrets_encrypted file and start over.

It would be good to have a method to do this.

We might also consider letting ToolHive generate a random password, assuming keyring access is verified on the user's system? (This could also imply an additional thv secret init --generate command to do this initially, and/or a question when running the first secret command?)

Potential workflow

Interactive version:

$ thv secret rotate-password
Enter the new encryption password: 

# User enters new password, ToolHive re-encrypts the file, then updates the keyring entry

Non-interactive version:

$ thv secret rotate-password --generate

# ToolHive generates a strong random password, re-encrypts the file, then updates the keyring entry
# IF keyring update fails for any reason, display the generated password to the user so they're not locked out of their file?

Start by tracing the existing thv secret commands, especially thv secret reset-keyring, and the handling of the secrets_encrypted file and keyring entry. Decide how interactive and generated-password rotation should behave, including keyring-update failure, then define tests for re-encryption and recovery before implementing the command.