feat: add key:rotate command

[paulbalandan]

Description
Adds a key:rotate spark command that demotes the current encryption.key to encryption.previousKeys in .env and generates a fresh key, so existing ciphertext stays decryptable via the KeyRotationDecorator fallback.

The actual key write is delegated to key:generate to avoid duplicating that logic; previousKeys is written first so a failure mid-rotation leaves a stale-but-decryptable .env rather than risking key loss. Options: --force/-f, --prefix, --length, and --keep=N to cap the retained list.

Two small support pieces in system/CLI/:

• NullInputOutput — an InputOutput sink for silencing a sub-command invoked via AbstractCommand::call().
• CLI::getInputOutput() — @internal getter symmetric to setInputOutput() / resetInputOutput(), so callers can save and restore the prior IO.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide