Rotate an expiring TLS certificate

Practice the certificate-rotation order from platform-ops training so the old cert is not revoked before the new one is serving traffic.

1. Generate or import the new certificate and private key in the vault.
2. Install the new cert on the staging listener.
3. Validate the chain, SAN, and handshake.
4. Schedule the production cutover in the change window.
5. Switch the production listener to the new cert.
6. Confirm external monitors and clients succeed.
7. Revoke or archive the old cert only after cutover is confirmed.