feat(REQ-012): implement service token rotation CLI

- Add service token rotation CLI command with force flag support
- Implement token rotation in auth service with expiration handling
- Add portfolio repository helper for transaction/batch operations
- Add cascade delete support in postgres repository
- Add comprehensive CLI tests for service token operations
- Add REQ-012 specification for service token rotation
- Create BAT-002 delivery batch for token rotation implementation
- Update SRS and batch indexes

app/cli/commands/service_tokens.py

@@ -114,3 +114,36 @@ def revoke_service_token(
         revoked_at=revoked_at,
     )
     render_service_token_result(ctx.obj.console, ctx.obj.output_format, response)
+
+
+@token_app.command("rotate")
+def rotate_service_token(
+    ctx: typer.Context,
+    name: str = typer.Argument(..., help="Service token name to rotate."),
+    force: bool = typer.Option(False, "--force", "-f", help="Skip confirmation prompt."),
+) -> None:
+    if not force:
+        confirmed = typer.confirm(f"서비스 토큰 '{name}'을 갱신하시겠습니까?")
+        if not confirmed:
+            raise typer.Exit(code=0)
+
+    def _rotate(service: AuthService, app_context):
+        return service.rotate_service_token(name)
+
+    issued = _with_service(ctx, _rotate)
+    response = ServiceTokenIssueCliResponse(
+        token_id=issued.auth_token.id,
+        name=name,
+        expires_at=issued.auth_token.expires_at,
+        revoked=issued.auth_token.revoked_at is not None,
+        runtime_id=issued.auth_token.runtime_id,
+        token=issued.token,
+    )
+
+    if ctx.obj.output_format == "json":
+        from app.cli.core.utils import render_output
+        render_output(ctx.obj.console, "json", response.model_dump(mode="json"))
+    else:
+        ctx.obj.console.print("[bold yellow]⚠ 갱신된 토큰 원문은 지금 1회만 표시됩니다. 안전한 곳에 저장하세요.[/bold yellow]")
+        ctx.obj.console.print(f"[bold green]token:[/bold green] {issued.token}")
+        render_service_token_result(ctx.obj.console, ctx.obj.output_format, response)