rotateStorageKey

Starts a storage key rotation and returns the new current key ID.

Allocates the next key ID (committed first, so it is never reused), has the StorageKeyProvider create and persist that key, reads it back, and then makes it current in one transaction: from then on every new record is sealed with it, while records of the previous key stay readable. The previous key is re-encrypted away and retired by resumeStorageKeyRotation.

If a start was interrupted (StorageKeyRotationPhase.PREPARING), this finishes it with the key ID already allocated. Throws StorageKeyRotationInProgressException while a rotation is migrating or retiring; StorageEncryptionException.KeyIdsExhausted if no key ID is left; StorageEncryptionException.KeyUnavailable if the provider cannot create or return the key (the database then still uses its current key). The state machine is StorageKeyRotationManager.