Class RotateEncryptionKeyAction

Action for rotating encryption keys with full re-encryption of affected data.

Key rotation involves:

1. Validating the new key is accessible
2. Setting key status to 'Rotating'
3. For each entity field using this key:
   • Loading all records in batches
   • Decrypting with old key
   • Re-encrypting with new key
   • Updating records
4. Updating key metadata (lookup value, version)
5. Setting key status back to 'Active'

Transaction Safety

• Each batch is processed within a transaction
• On batch failure, the entire rotation is rolled back
• Key status is reset to 'Active' on failure