feat(REQ-012): implement service token rotation CLI

- Add service token rotation CLI command with force flag support
- Implement token rotation in auth service with expiration handling
- Add portfolio repository helper for transaction/batch operations
- Add cascade delete support in postgres repository
- Add comprehensive CLI tests for service token operations
- Add REQ-012 specification for service token rotation
- Create BAT-002 delivery batch for token rotation implementation
- Update SRS and batch indexes

app/services/auth_service.py

@@ -155,6 +155,24 @@ class AuthService:
         self._repository.revoke_auth_token(existing.user_id, existing.id)
         return datetime.now(timezone.utc)
 
+    def rotate_service_token(self, name: str) -> IssuedServiceToken:
+        existing = self._repository.get_service_token_by_name(name)
+        if existing is None:
+            raise ValueError(f"서비스 토큰을 찾을 수 없습니다: {name}")
+        if existing.revoked_at is not None:
+            raise ValueError(f"이미 폐기된 서비스 토큰입니다: {name}")
+        if existing.expires_at is not None:
+            raise ValueError(f"만료일이 설정된 토큰은 rotate할 수 없습니다: {name}. revoke 후 재발급하세요.")
+        raw_token = generate_token()
+        new_runtime_id = str(uuid.uuid4())
+        auth_token = self._repository.rotate_service_token(
+            existing.id,
+            token_hash=hash_token(raw_token),
+            token_prefix=token_prefix(raw_token),
+            runtime_id=new_runtime_id,
+        )
+        return IssuedServiceToken(token=raw_token, auth_token=auth_token)
+
     def list_service_tokens(
         self,
         username: str | None = None,