Release v7.47.1

Changed

• The shop example's ApiKey is identified by a separate ApiKeyId, because an event-source ID is plaintext metadata that cannot be encrypted; ApiKey stays a secret value property (part of #576)
• The generated-values reference explains how Chronicle checks generated-value freshness: a batch's scopes once, all or nothing, before the batch, and again on a storage retry that renumbers the append (part of #576)