security: secret rotation procedure

[jonmatum]

Priority: P1
Parent: #34
Promotes: SEC-7 from #28

Context

No documented rotation procedure for any long-lived credential. Cognito app client secret, MCP client credential, and any third-party webhook secrets are set-and-forget.

Requirements

Inventory

• docs/ops/secrets.md lists every secret, its owner, its storage (Secrets Manager / SSM / env), and its current rotation cadence

Procedures

• Cognito app client secret rotation (dual-secret window, frontend deploy, old-secret revoke)
• MCP client credential rotation (see MCP Gateway setup)
• Any external webhook / API token rotation
• Terraform state bucket KMS key rotation (AWS-managed already, but document)

Automation (nice-to-have, not blocking)

• Secrets Manager automatic rotation Lambda for rotatable secrets

Acceptance criteria

• secrets.md published
• At least one real rotation executed end-to-end and recorded (with wall-clock impact on users)

References

• Production readiness — consolidated plan (tracking) #34 (parent)
• AWS Well-Architected Framework assessment — gaps and remediation plan #28 SEC-7