feat(REQ-012): implement service token rotation CLI

- Add service token rotation CLI command with force flag support
- Implement token rotation in auth service with expiration handling
- Add portfolio repository helper for transaction/batch operations
- Add cascade delete support in postgres repository
- Add comprehensive CLI tests for service token operations
- Add REQ-012 specification for service token rotation
- Create BAT-002 delivery batch for token rotation implementation
- Update SRS and batch indexes

app/repositories/portfolio_repository.py

@@ -65,6 +65,14 @@ class PortfolioRepository(Protocol):
 
     def revoke_auth_token(self, user_id: str, token_id: str) -> None: ...
 
+    def rotate_service_token(
+        self,
+        token_id: str,
+        token_hash: str,
+        token_prefix: str,
+        runtime_id: str,
+    ) -> AuthToken: ...
+
     def get_service_token_by_name(self, name: str) -> AuthToken | None: ...
 
     def get_token_principal(self, token_hash: str) -> TokenPrincipal | None: ...