Master key rotation, rekey and status #171

Rotate a tenant's or the server's master key (new version active, old retired), broadcast the rotation, rewrap every data key of the owner in a background job, then destroy the retired key. Management API: GET and POST …/encryption-keys/rekey for tenants and the server (Auth0 parity), scopes read:encryption_keys / update:encryption_keys, audit events; yearly automatic rotation.

• Seam: IMasterKeyManager (public, Abstractions) with GetStatusAsync(SecretOwner, ct) (versions, created, retired, provider, recovery present — never material) and RotateAsync(SecretOwner, ct).
• Rotate: in one unit of work create version n+1 (active) and set RetiredWhen on the old key; broadcast MasterKeyRotated(owner) through IReplicaBroadcaster; every replica calls Evict(owner) and, for the server owner, refreshes ServerSecretProtectorHolder.
• Rewrap job (NCode.Identity.Dispatch, delayed about five minutes so replicas converge): for each of the owner's secrets whose envelope names the retired key, unwrap the data key with the old purpose key and wrap it with the new one; the payload is untouched because payload associated data carries an all-zero key id (ADR-0235). Owner's secrets: a tenant's TenantSecrets, its clients' and resource servers' secrets; the server's ServerSecrets. Write through the owner stores' UpdateSecretAsync with concurrency tokens; re-run on conflict.
• Data Protection: existing ring keys are not re-encrypted; new ring keys use the new master key, and the retired server key is kept until every ring key it wrapped has expired (Data Protection default lifetime 90 days) plus a grace period.
• Destroy: when a verification scan finds no reference, delete the retired row. Backups keep their own copies.
• Management API (Auth0 parity with POST /api/v2/keys/encryption/rekey): GET /api/tenants/{tenantId}/encryption-keys, POST /api/tenants/{tenantId}/encryption-keys/rekey, and /api/servers/{serverId}/… equivalents; scopes read:encryption_keys / update:encryption_keys; audit events master_key_rotated, master_key_destroyed.
• Automatic rotation: a hosted timer dispatches a daily job that rotates any active key older than SecretProtection:MasterKeyRotationPeriod (default 365 days).