rotate: Resend API-key driver (create→verify→revoke)

First of the vibe-coder API-rotation batch. Resend mints a new API key
authenticated by the old one (POST /api-keys), verifies it by listing keys
with the new Bearer token and asserting its id is present, then deletes the
old key by id (DELETE /api-keys/<id>). Self-contained blob
resend://host/?id=&secret= keeps the token off Identity/Meta/logs/argv.

httptest emulator enforces Bearer validity (key authenticates only while it
exists) so the test proves a real cutover: old dead, new alive, plus a leak
check. Recorded MOCK-ONLY in proofs.go + ROTATION-PROOFS.md (no self-host).

Note: GitHub PAT is intentionally NOT an API Rotator — GitHub has no
create-token API (classic Authorizations API removed 2020; fine-grained PATs
are UI-only), so a PAT belongs in the guided/worklist path, not here.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/ROTATION-PROOFS.md

@@ -68,6 +68,7 @@ stops a mock-only driver from ever being mistaken for a live one.
 | `gcp` | `httptest` IAM emulator (verifies the driver's RS256 JWT against the key's public key) | no self-host |
 | `twilio` | `httptest` emulator (Basic-auth Keys resource) | no self-host |
 | `flyio` | `httptest` GraphQL emulator | no self-host |
+| `resend` | `httptest` emulator (Bearer `/api-keys` resource) | no self-host |
 
 ## What the MOCK-ONLY emulators actually prove
 
@@ -82,10 +83,11 @@ protocol so the test exercises the driver's true cutover logic:
   on `PUT` **decrypts the sealed value** and stores the plaintext; the test asserts the
   decrypted value equals the new value the driver put in the rebuilt blob — proving the
   sealed-box encryption is correct, not simulated.
-- **npm / twilio** — each emulator enforces credential validity (a token/key
+- **npm / twilio / resend** — each emulator enforces credential validity (a token/key
   authenticates only while it exists) and the test asserts `Verify(old)` fails after
   `RevokeOld` — proving the create→verify→revoke cutover really happened, old credential
-  dead, new one alive.
+  dead, new one alive. (Resend additionally proves `Verify(new)` by listing keys with the
+  new Bearer token and asserting the new id is present — auth success *and* the key exists.)
 - **gcp** — the emulator **verifies the RS256 JWT signature** the driver mints against the
   public key recorded for the key's `kid`; it only issues an access token for a JWT that
   actually verifies, and `DELETE` removes the key — so the test proves real service-account