feat(fof-layer4): Tauri commands + Settings "Rotate my vouch key" UI

Three new Tauri commands surface Layer 4 to the frontend:

- rotate_v_me() -> { newEpoch }: generates next V_me epoch +
  republishes bio. Old epoch retained in vouch_keys_own; existing
  vouchees receive the new key on their next bio-scan.
- cascade_revoke_v_me_epoch(retired_epoch, reason_code) ->
  { postsRevoked }: bulk per-post revocation across every author
  post that sealed slots under (self, retired_epoch). Useful as a
  follow-up after rotate_v_me when the author wants to actively
  cut off comment access on old posts.
- key_burn_post_slot(post_id_hex, slot_index, new_v_x_hex): the
  leaked-V_me primitive. Re-seals one slot under a different V_x.

Frontend (Settings → Vouches):
- New "Rotate my vouch key" button + status pill below the Given /
  Received lists.
- Confirmation prompt explains the grandfather-by-default semantics:
  "old posts remain readable to anyone who held the old key — cascade-
  revoke separately if you want to cut off old-content access."
- Wired once per settings-tab activation.

Cascade-revoke and key-burn surfaces aren't visualized yet (require
per-post selection UI); the Tauri commands are available for follow-up
UI work or scripting via the desktop dev console.

Workspace builds clean; 148 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/app.js

@@ -3154,7 +3154,16 @@ document.querySelectorAll('.tab').forEach(tab => {
                 loadMessages(true); loadDmRecipientOptions();
                 clearNotifications('msg-');
             }
-            if (target === 'settings') { loadIdentities(); loadPersonas(); loadRedundancy(); loadPublicVisible(); loadCacheSizeSetting(); loadUpdateSettings(); loadIgnored(); loadVouches(); }
+            if (target === 'settings') {
+                loadIdentities(); loadPersonas(); loadRedundancy(); loadPublicVisible();
+                loadCacheSizeSetting(); loadUpdateSettings(); loadIgnored(); loadVouches();
+                // FoF Layer 4: rotate button wires once per settings open.
+                const rotateBtn = document.getElementById('rotate-v-me-btn');
+                if (rotateBtn && !rotateBtn._wired) {
+                    rotateBtn.addEventListener('click', rotateVMe);
+                    rotateBtn._wired = true;
+                }
+            }
         });
     });
 });
@@ -3710,6 +3719,26 @@ async function loadIgnored() {
     }
 }
 
+async function rotateVMe() {
+    const btn = document.getElementById('rotate-v-me-btn');
+    const status = document.getElementById('rotate-v-me-status');
+    if (!btn) return;
+    if (!confirm('Rotate your vouch key? A new key will be issued to all current vouchees via your next bio post. Old posts remain readable to anyone who held the old key — cascade-revoke separately if you want to cut off old-content access.')) return;
+    btn.disabled = true;
+    status.textContent = 'Rotating…';
+    try {
+        const { newEpoch } = await invoke('rotate_v_me');
+        status.textContent = `Rotated → epoch ${newEpoch}`;
+        toast(`Vouch key rotated to epoch ${newEpoch}`);
+        loadVouches();
+    } catch (e) {
+        status.textContent = '';
+        toast('Error: ' + e);
+    } finally {
+        btn.disabled = false;
+    }
+}
+
 async function loadVouches() {
     const givenEl = document.getElementById('vouches-given-list');
     const recvEl = document.getElementById('vouches-received-list');