Address Copilot review comments on WIF admin PR

- E2E teardown: let `ServerResponseError` from `auth_federation.delete()`
  propagate instead of swallowing it. A failed teardown left WIF enabled
  on the site, so the next run would hit the fixture's `enabled=True`
  guard and silently skip — the destructive paths stopped being
  exercised without anyone noticing.
- Key-rotation guidance (endpoint docstring, CHANGELOG, and docs): the
  previous `create_key() -> activate_key(new) -> delete_key(old)`
  sequence omitted that the old key must stay in the JWKS until every
  JWT it signed has expired. Deleting it immediately removes it from
  the key set, and verifiers that fetch JWKS afterwards reject the
  still-valid tokens signed with it. New guidance keeps the old key
  inactive (but published) for up to `token_lifetime_seconds` before
  deleting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sushmasreedharan-tableau

CHANGELOG.md

@@ -39,9 +39,13 @@
     or an `AuthFederationKeyItem` with `kid` set; `activate_key` is atomic
     and deactivates any previously active key. `delete_key` fails with 400
     if the key is currently active. Safe rotation is `create_key()` →
-    `activate_key(new_kid)` → `delete_key(old_kid)`; `deactivate_key` on
-    the active key with no replacement leaves the site unable to mint WIF
-    tokens. The four key-management methods are bound to `NO_ACCESS`
+    `activate_key(new_kid)`, then retain the old (now-inactive) key in the
+    site's JWKS until every JWT it signed has expired (upper bound: the
+    site's current `token_lifetime_seconds`), and only then
+    `delete_key(old_kid)` — deleting it earlier removes it from the JWKS
+    and any verifier fetching the key set afterwards will reject still-
+    unexpired tokens signed with it. `deactivate_key` on the active key
+    with no replacement leaves the site unable to mint WIF tokens. The four key-management methods are bound to `NO_ACCESS`
     server-side, which only rejects OAuth-scope-restricted sessions
     (e.g. connected-app JWT) with 401; password and personal-access-token
     (PAT) sessions do not carry scopes and are accepted.

tableauserverclient/server/endpoint/auth_federation_endpoint.py

@@ -311,12 +311,19 @@ def delete_key(self, key: KeyIdentifier) -> None:
         """
         Delete a WIF signing key. Fails with 400 if the key is active.
 
-        For rotation, call ``create_key()`` → ``activate_key(new_kid)`` →
-        ``delete_key(old_kid)``: ``activate_key`` atomically deactivates the
-        previously active key, so the site is never without an active signing
-        key. Calling ``deactivate_key`` on the active key before another is
-        activated leaves the site with no active key, and no new WIF tokens
-        can be minted until a replacement is activated.
+        For rotation, call ``create_key()`` → ``activate_key(new_kid)``, then
+        **retain** the old (now-inactive) key in the site's JWKS until every
+        JWT it signed has expired (upper bound: the site's current
+        ``token_lifetime_seconds``, default 7200 s / 2 h), and only then
+        call ``delete_key(old_kid)``. ``activate_key`` atomically deactivates
+        the previously active key, so the site is never without an active
+        signing key — but the inactive key stays published in the JWKS so
+        verifiers can keep validating tokens it already signed. Deleting it
+        before those tokens have expired removes it from the JWKS, and any
+        verifier that fetches the key set afterwards will reject the still-
+        unexpired tokens. Calling ``deactivate_key`` on the active key
+        before another is activated leaves the site with no active key, and
+        no new WIF tokens can be minted until a replacement is activated.
 
         Parameters
         ----------

test_e2e/test_auth_federation.py

@@ -60,10 +60,11 @@ def wif_site(server):
 
     yield server
 
-    try:
-        server.auth_federation.delete()
-    except ServerResponseError:
-        pass
+    # Let any ServerResponseError propagate: a failed teardown delete must
+    # surface as a pytest teardown error. Swallowing it would leave WIF
+    # enabled on the site, so the next run would skip (fixture guard above)
+    # and silently stop exercising the destructive paths.
+    server.auth_federation.delete()
 
 
 def test_wif_round_trip_bare_body_wire_contract(wif_site):