rotateToken

Rotate the primary bearer token, invalidating the old one. Paired-client tokens are unaffected. Returns the new token, or null on an open server. Surface the new value in a fresh pairing QR.