v0.4.1

Added

• Add runapi listen --rotate-secret for explicit per-key Listen Signing Secret recovery.

Changed

• Verify the selected key echoed by the API, print only the rotated secret, and document listener restart behavior.