feat(payments): add RotatePaymentConnectorCredentials support

[walunjv]

What

Expose on-demand rotation of a payment connector's service-managed credentials, and surface the two connector fields that operation relies on.

• PaymentClient.rotate_payment_connector_credentials() wraps the control plane operation. It builds the credentialsToRotate union and validates it against the model's constraints — non-empty secrets, @uniqueItems de-duplication, known secret names — so bad input fails locally instead of round-tripping.
• New CoinbaseCdpSecret constant (API_KEY, WALLET_SECRET) names the rotatable secrets. An enum rather than a bool, so new secret kinds can be added without a breaking change.
• The operation is allowlisted in _ALLOWED_PAYMENTS_CP_METHODS, so it is also reachable through direct boto3 forwarding.
• get_payment_connector() and list_payment_connectors() now return provisionMode, and get_payment_connector() returns credentialsUpdatedAt when the service supplies it. Both were previously dropped by the hand-built result dicts, leaving callers no way to tell whether a connector's credentials are service-managed or how old they are.

Rotation applies only to connectors with a provisionMode of QUICK_CREATE, whose credentials the service issued and stores. MANUAL connectors are unaffected — the caller owns those credentials and rotates them with the payment provider directly. StripePrivy is rejected with a clear error, since it has no rotatable service-managed secrets today.

The rotation completes before the response returns, so the wrapper has no wait_for_ready parameter and nothing to poll. Only one rotation runs at a time per connector, so a concurrent call surfaces ConflictException.

Tests

• 16 new cases in tests/bedrock_agentcore/payments/test_client.py across three classes: the union builder, the client method, and the new response fields. Covers enum and string inputs, de-duplication, each validation error, generated vs. caller-supplied client tokens, validation happening before any request is issued, ConflictException propagation, and credentialsUpdatedAt being omitted for MANUAL connectors.
• Full payments suite: 917 passed, 9 skipped. Coverage 91% overall, constants.py at 100%.
• ruff check and ruff format --check clean.

[Khusbu]

Do we need to add this check here? Backend level check is good enough, no?

[walunjv]

Agreed, removed in f3e7621. The service is the single source of truth now — all three checks were duplicating constraints the model already enforces (CoinbaseCdpSecret enum, @length(min: 1), @uniqueItems), so a secret name the service adds would have been rejected client-side until the SDK cut a release. Invalid input now surfaces as a ValidationException from the service.

One thing beyond your comment: I removed the connector_type parameter too, not just the check. CredentialRotationConfig models exactly one member (coinbaseCDP), so the parameter was selecting from a set of one — dropping only the if would have silently built a coinbaseCDP payload for anyone passing StripePrivy. The README example never passed it, so nothing user-facing changes.

Left _build_provider_config_input's vendor check alone — that one picks between two genuinely different payload shapes, so an unknown vendor has no correct output.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@889615f). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #676   +/-   ##
=======================================
  Coverage        ?   89.55%           
=======================================
  Files           ?      123           
  Lines           ?    10733           
  Branches        ?     1682           
=======================================
  Hits            ?     9612           
  Misses          ?      733           
  Partials        ?      388           

Flag	Coverage Δ
unittests	89.55% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.