rotateSignedPreKey

Replaces the current signed prekey with a new one and returns its public half. The old private key stays stored for PreKeyConfiguration.signedPreKeyGracePeriod, so first-contact messages that still use it can be decrypted. Local only: call publishPreKeys afterwards.