fix(deploy): support bootstrap password rotation

scripts/vector-rotate-bootstrap-password.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 OLD_SECRET_FILE NEW_SECRET_FILE" >&2
+  exit 2
+fi
+
+absolute_file() {
+  directory=$(CDPATH= cd -- "$(dirname -- "$1")" && pwd)
+  printf '%s/%s\n' "$directory" "$(basename -- "$1")"
+}
+
+old_secret=$(absolute_file "$1")
+new_secret=$(absolute_file "$2")
+for secret in "$old_secret" "$new_secret"; do
+  if [ ! -f "$secret" ] || [ ! -r "$secret" ] || [ ! -s "$secret" ]; then
+    echo "secret file must be a readable, non-empty regular file: $secret" >&2
+    exit 2
+  fi
+done
+if [ "$old_secret" -ef "$new_secret" ]; then
+  echo "old and new secret files must be distinct" >&2
+  exit 2
+fi
+
+project=${COMPOSE_PROJECT_NAME:-thothii}
+replacement=$(mktemp "${old_secret}.rotate.XXXXXX")
+trap 'rm -f "$replacement"' EXIT HUP INT TERM
+cp "$new_secret" "$replacement"
+chmod 0600 "$replacement"
+
+docker compose --project-name "$project" --profile local-vector run --rm --no-deps \
+  --user 0:0 \
+  --entrypoint /opt/venv/bin/python \
+  --volume "$old_secret:/run/secrets/bootstrap-old:ro" \
+  --volume "$new_secret:/run/secrets/bootstrap-new:ro" \
+  --volume "$(pwd)/deploy/vector/rotate-bootstrap-password.py:/opt/thoth/rotate-bootstrap-password.py:ro" \
+  core /opt/thoth/rotate-bootstrap-password.py \
+  /run/secrets/bootstrap-old /run/secrets/bootstrap-new
+
+mv -f "$replacement" "$old_secret"
+trap - EXIT HUP INT TERM
+
+echo "Deployment bootstrap secret atomically replaced only after verified database login."
+echo "Re-run: docker compose --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"