## Summary

Master key and virtual key rotation currently have no notification mechanism and produce misleading log output. This creates operational pain for admins and end users.

### 1. Email alerts on key rotation

When a virtual key is regenerated (`POST /key/regenerate`), the key owner receives no notification — they just discover their key stopped working. The new key value is only returned in the API response to the admin who triggered the rotation.

**Proposal:** Send an email notification to the key owner containing the new key value (or a link to retrieve it from the UI). For master key rotation, send a confirmation to the admin.

### 2. Auto-rotation should require SSO/SCIM

If auto-rotation is enabled for virtual keys, there's no way to deliver the new key to the user unless we have their email. Without SSO/SCIM configured, users may not have an email on file.

**Proposal:** Gate the auto-rotation feature behind SSO/SCIM configuration. If no SSO is configured, auto-rotation should be disabled (or warn the admin) since there's no reliable way to notify key owners of the new key.

### 3. Default email alerts for SSO/SCIM users on auto-rotation

When SSO/SCIM is configured…