Resume committed rotations without asking for another signing secret

Compare the persisted generation with the saved request baseline, keep one-time plaintext separate from reconnect readiness, and reset local state for a new rotation objective. Cover verified, pending-verification, and unchanged generations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/shared/src/types/chat-channels.ts

@@ -229,6 +229,8 @@ export interface ChatEndpointSetupState {
   testSkipped?: boolean;
   /** Set only after the provider has delivered a signed callback challenge. */
   webhookVerifiedAt?: string | null;
+  /** Nonsecret generation used to resume a requested signing-secret rotation. */
+  credentialRotationId?: string | null;
   authorizationUrl?: string | null;
   providerUrl?: string | null;
   command?: string | null;