Generates a new signing secret for the endpoint. During a 24-hour overlap window, both the old and new secrets sign every delivery so consumers can migrate without dropped events. Store the new secret immediately — it is not retrievable after this response.