quantum phase 3: add KeyVault lifecycle UX and read-path compatibility — introduces cast quantum subcommand group (bootstrap / add-key / remove-key / update-key-auth) that reuses the shared CastTxBuilder + ML-DSA signing pipeline, routes through `Quan#4