Rework key-lifecycle docstrings per PR #1894 review

- deactivate_key: absorb the "deactivate on the active key with no
  replacement leaves the site unable to mint" warning, which belongs
  on deactivate_key itself (not delete_key).
- delete_key: drop the create_key / activate_key chain from the
  rotation guidance. Reframe the docstring around what distinguishes
  delete from deactivate: both stop new signing with the key, but
  delete also pulls it from the JWKS, so still-unexpired tokens signed
  with it stop verifying. Rotation guidance now reduces to "keep the
  old key deactivated-but-published until its tokens expire, then
  delete".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sushmasreedharan-tableau

tableauserverclient/server/endpoint/auth_federation_endpoint.py

@@ -295,6 +295,9 @@ def deactivate_key(self, key: KeyIdentifier) -> None:
         Deactivate the given key. A deactivated key stays on the site (and in
         the public JWKS) so that already-issued JWTs can still be verified
         during their validity window, but no new JWTs will be signed with it.
+        Deactivating the active key before another is activated leaves the
+        site with no active key, and no new WIF tokens can be minted until
+        a replacement is activated.
 
         Parameters
         ----------
@@ -311,19 +314,14 @@ def delete_key(self, key: KeyIdentifier) -> None:
         """
         Delete a WIF signing key. Fails with 400 if the key is active.
 
-        For rotation, call ``create_key()`` → ``activate_key(new_kid)``, then
-        **retain** the old (now-inactive) key in the site's JWKS until every
-        JWT it signed has expired (upper bound: the site's current
-        ``token_lifetime_seconds``, default 7200 s / 2 h), and only then
-        call ``delete_key(old_kid)``. ``activate_key`` atomically deactivates
-        the previously active key, so the site is never without an active
-        signing key — but the inactive key stays published in the JWKS so
-        verifiers can keep validating tokens it already signed. Deleting it
-        before those tokens have expired removes it from the JWKS, and any
-        verifier that fetches the key set afterwards will reject the still-
-        unexpired tokens. Calling ``deactivate_key`` on the active key
-        before another is activated leaves the site with no active key, and
-        no new WIF tokens can be minted until a replacement is activated.
+        Unlike ``deactivate_key``, which keeps the (now-inactive) key
+        published in the site's JWKS so that already-issued JWTs can still
+        be verified, ``delete_key`` removes the key from the JWKS entirely —
+        any verifier that fetches the key set afterwards will reject still-
+        unexpired tokens signed with it. For a safe rotation, keep the old
+        key deactivated-but-published until every JWT it signed has expired
+        (upper bound: the site's current ``token_lifetime_seconds``, default
+        7200 s / 2 h), and only then delete it.
 
         Parameters
         ----------