add token rotation helper

bin/rotate-token.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Ask the relay to mint a fresh operator token and print it. Paste the result
+# into your own .env; do not commit it. Rotating invalidates the previous one.
+set -eu
+. "$(dirname "$0")/../.env"
+curl -ks -X POST \
+  -H "Authorization: Bearer ${RELAY_TOKEN}" \
+  "${RELAY_ENDPOINT}/operator/token:rotate" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p'