[Security] Add API Key Rotation Support

[Abd-Standard]

Description

Allow administrators to rotate API credentials without downtime.

Acceptance Criteria
Multiple keys can coexist temporarily.
Old keys can be revoked safely.
Rotation process is documented.

[Babigdk]

Proposal: API Key Rotation Support (Zero-Downtime Credential Management)

I’d like to implement secure API key rotation to allow administrators to update credentials without service disruption.

Scope of Work:

• Support multiple active API keys simultaneously (key versioning or key list)
• Implement key validation middleware that checks against active key store
• Add safe revocation mechanism for individual keys without affecting others
• Ensure backward compatibility during rotation window
• Add optional key metadata (createdAt, revokedAt, status: active/revoked)

Implementation Approach:

• Introduce a key registry (in-memory or persistent store depending on config)
• Validate requests against all non-revoked keys
• Allow gradual deactivation of old keys
• Ensure no downtime during key swap (dual-key overlap period)

Deliverables:

• Multi-key authentication system
• Key rotation and revocation logic
• Secure middleware updates
• Documentation describing rotation workflow and best practices

Goal:
Enable secure, zero-downtime API credential rotation while maintaining backward compatibility and operational safety.