Rotate production secrets with dual-key overlap, not an edit to .env

Sandbox credentials are disposable. Production credentials on a backend you own are not. Once the process is serving real traffic, rotating a database password, a webhook signing secret, a provider AP