Rotating Upstash tokens: reset password, redistribute, verify the old one fails

# Rotating Upstash Redis tokens without an outage

## When to rotate

- A standard token appeared anywhere client side or in a log.
- Team member with access leaves.
- Periodic hygiene, at whatever cadence your policy sets.

## The procedure

1. Inventory every place the token lives: env vars, secret
   managers, CI secrets, wrangler secrets, local env files,
   hardcoded fallbacks (fix those separately).
2. Generate the new credential: reset the database password in the
   console. This revokes both the standard and read-only tokens
   at once.
3. Update secret stores first, then redeploy or restart every
   consumer. Keep the rollout tight: between reset and redeploy,
   old tokens fail closed.
4. For ACL setups, re-mint per-user tokens with ACL RESTTOKEN
   after the reset.

## Reduce the blast radius next time

- One database per environment (dev, staging, prod) so a rotation
  never touches prod while you practice on dev.
- Read-only tokens for anything client facing: they cannot write,
  so a leak is contained.
- Per-user ACL tokens for humans and services instead of sharing
  the standard token.

## Verify

After rotation: every consumer connects with the new token, the old
token gets 401/WRONGPASS everywhere you test it, and the console
shows fresh last-used timestamps.