ops: write docs/operations/update-saml2-certificate.md

[themightychris]

SAML IdP cert rotation procedure to parallel laddr's legacy doc.

Per specs/api/saml.md, the rotation steps are:

1. Generate new key + cert
2. Update Slack's admin UI with the new public cert
3. Update the API's SAML_PRIVATE_KEY / SAML_CERTIFICATE secrets
4. Restart the API

The doc should expand these into runnable commands (openssl invocation, Slack admin UI link, our secrets backend), and include the cadence (3 years). Surfaced by the saml-idp plan's closeout (PR #49) — the runbook step isn't owned by any other planned work.