Envelope mode: rotate the Transit KEK and rewrap stored DEKs

[WailedParsley36]

VaultEnvelopeEncryptor.RotateAsync mints a fresh data-encryption key and advances the keyring, but never rotates the Transit key-encryption key (KEK) nor rewraps the stored wrapped-DEKs onto a newer KEK version. Add an opt-in KEK-hygiene step:

• Rotate the KEK (POST transit/keys/:name/rotate).
• transit/rewrap each wrapped DEK in the keyring secret onto the latest KEK version (VaultSharp exposes RewrapAsync). The DEK values are unchanged, so existing rows stay readable — this only re-protects the keyring secret.

Gate behind an option (e.g. RewrapKeyringOnRotation).