rotate: Vercel token + SendGrid API-key drivers (create→verify→revoke)

Two more provider-API rotation drivers for the vibe-coder credential surface,
both following the create-new → verify → revoke-old pattern with the
self-contained blob form <provider>://<host>/?id=&secret=.

- vercel: POST /v3/user/tokens mints a new bearer; Verify lists tokens and
  asserts the new id is present; RevokeOld DELETEs the old token by id.
- sendgrid: clones the old key's scopes (GET /v3/api_keys/<id>) onto the new
  key so rotation is a faithful replacement, not a privilege downgrade; Verify
  is a GET /v3/scopes auth proof; RevokeOld DELETEs the old key by id.

Both ship Bearer-enforcing httptest emulators that prove a real cutover (old
credential dead, new alive after RevokeOld) plus a leak check. Recorded as
MOCK-ONLY in proofs.go + docs/ROTATION-PROOFS.md (no self-host). go build/vet
clean; 77 rotate tests pass, -race clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/rotate/proofs.go

@@ -70,6 +70,8 @@ var proofLevels = map[string]ProofLevel{
 	"twilio":     ProofMockOnly, // httptest emulator; no self-host
 	"flyio":      ProofMockOnly, // httptest GraphQL emulator; no self-host
 	"resend":     ProofMockOnly, // httptest emulator; no self-host (real key needs a paid-ish account)
+	"vercel":     ProofMockOnly, // httptest emulator; no self-host
+	"sendgrid":   ProofMockOnly, // httptest emulator; no self-host
 }
 
 // ProofLevelOf returns the recorded proof level for a driver name. Unknown or