feat(REQ-012): implement service token rotation CLI

- Add service token rotation CLI command with force flag support
- Implement token rotation in auth service with expiration handling
- Add portfolio repository helper for transaction/batch operations
- Add cascade delete support in postgres repository
- Add comprehensive CLI tests for service token operations
- Add REQ-012 specification for service token rotation
- Create BAT-002 delivery batch for token rotation implementation
- Update SRS and batch indexes

app/repositories/postgres.py

@@ -600,6 +600,31 @@ class PostgresPortfolioRepository:
             if row is None:
                 raise ValueError("토큰을 찾을 수 없습니다")
 
+    def rotate_service_token(
+        self,
+        token_id: str,
+        token_hash: str,
+        token_prefix: str,
+        runtime_id: str,
+    ) -> AuthToken:
+        self.ensure_schema()
+        with self._connect().cursor() as cur:
+            cur.execute(
+                """
+                UPDATE auth_tokens
+                SET token_hash = %s, token_prefix = %s, runtime_id = %s
+                WHERE id = %s AND token_type = 'service' AND revoked_at IS NULL
+                RETURNING
+                    id, user_id, name, token_prefix, permission, token_type,
+                    expires_at, last_used_at, revoked_at, created_at, runtime_id
+                """,
+                (token_hash, token_prefix, runtime_id, token_id),
+            )
+            row = cur.fetchone()
+            if row is None:
+                raise ValueError("토큰을 찾을 수 없습니다")
+        return self._row_to_auth_token(row)
+
     def get_service_token_by_name(self, name: str) -> AuthToken | None:
         self.ensure_schema()
         with self._connect().cursor() as cur: