Generates a new secret in ZITADEL, writes it into the Kubernetes Secret, rolls the consumer and checks it comes back. This is the manual execution of a KeyRotation, and the reference the controller must match. Two traps it records: the app resource id differs from the client id, and the secret endpoint is oidc_config/_generate_client_secret.