broker: retire the old LiteLLM key before re-creating a same-name key

LiteLLM requires unique key aliases, so re-creating a key with an existing
(email, name) pair 400s ('alias already exists') — breaking key rotation
from the dashboard. The stored LiteLLM hash lets us retire the old key
first; the ON CONFLICT upsert then tracks the new key.

Surfaced by the LibreChat sandbox work: the portal chat-key rotation for
an SSO member failed with exactly this 400.

app/main.py

@@ -1658,6 +1658,32 @@ async def broker_create_api_key(email: str, name: str) -> dict:
     team_id = await litellm_get_or_create_team(email, balance)
     alias = _api_key_alias(email, name)
     async with httpx.AsyncClient() as client:
+        # Rotation support: LiteLLM requires unique key aliases, so a re-create
+        # with an existing (email, name) must retire the old key first. Without
+        # this, rotating a key from the dashboard 400s ("alias already exists").
+        conn = get_db()
+        row = conn.execute(
+            "SELECT hash FROM member_api_keys WHERE email = ? AND name = ?",
+            (email, name),
+        ).fetchone()
+        conn.close()
+        if row and row[0]:
+            old_hash = row[0]
+            try:
+                del_res = await client.post(
+                    f"{LITELLM_BASE}/key/delete",
+                    headers={"Authorization": f"Bearer {LITELLM_MASTER_KEY}"},
+                    json={"keys": [old_hash]},
+                )
+                if del_res.status_code == 200:
+                    logger.info("Rotated API key %s for %s (old key retired)", name, email)
+                else:
+                    logger.warning(
+                        "Old key retire failed for %s/%s: %s %s",
+                        email, name, del_res.status_code, del_res.text[:200],
+                    )
+            except Exception as exc:  # noqa: BLE001 - rotation is best-effort
+                logger.warning("Old key retire errored for %s/%s: %s", email, name, exc)
         r = await client.post(
             f"{LITELLM_BASE}/key/generate",
             headers={"Authorization": f"Bearer {LITELLM_MASTER_KEY}"},