[QA] Test-fixture credential rotation is a manual DB operation with no supported path

[alseif0x]

Found while validating #177.

Problem

The --login-only smoke could not run at all because the BNet verifier of
TESTBOT1@bot.local did not match the password in the machine-local .env.local:

Error: Failed to provision test accounts: BNet fixture TESTBOT1@bot.local does not
exactly match configured credentials/offline state

Everything else about the fixture was clean — srp_version=1, 32-byte salt,
failed_logins=0, locked=0, online=0 — so the verifier was the only mismatch.

There is no supported way to fix that. provision_local_bot_account_create_only
(tools/wow-test-bot/src/main.rs:2889) is deliberately create-only:

Existing identities are validation-only. This makes repeated provisioning idempotent
while forbidding credential rewrites.

That rule is right for safety, but it leaves a dead end: once a disposable test
fixture's password is lost, the only way back is to hand-compute the SRP6 v1 verifier
and UPDATE battlenet_accounts directly — which is what had to be done to unblock #177,
outside the bot, as one-off scratch work. AGENTS.md explicitly calls that out as the
thing not to do ("useful bot improvements must be ported back to tools/wow-test-bot").

Suggested fix

Add an explicit, opt-in rotation path to the bot — e.g. WOW_BOT_ROTATE_FIXTURE_PASSWORD=1
or a rotate-fixture-credentials subcommand — that:

1. Refuses to run unless the account is a disposable local fixture (the existing
   @BOT.LOCAL guard plus WOW_BOT_ALLOW_NONLOCAL_ACCOUNT_BOOTSTRAP escape hatch).
2. Refuses if the fixture is banned, online, or owns more than one game account —
   the same preconditions validate_exact_bot_identity already enforces.
3. Generates a password, recomputes the verifier for the existing salt via
   bot_srp6::bnet_v1_verifier_for_salt_like_cpp, and writes both the DB row and the
   ignored .env.local in one step.
4. Never prints the password and never accepts it on argv.

This keeps "no silent credential rewrites" — rotation stays explicit and opt-in — while
removing the need for anyone to reimplement the SRP6 derivation by hand.

Related: #255 (reproducible database bootstrap and environment doctor) — a rotation
command belongs with that work if it lands first.

Done criteria

• A documented bot command rotates a local fixture password end to end.
• Guard tests cover the refuse-to-rotate preconditions.
• docs/AGENTS.md mention it where the smoke overrides are listed.