feat: KMS column-encryption rotation drill with resumable state and audit

[Fash004]

Closes:#557

Summary

Implements background column-level re-encryption (ColumnEncryptionRotator) for at-rest encrypted data when KMS keys are rotated. Tracks per-row key generation, maintains persisted resumable state across restarts, emits rotation.rows_reencrypted metric counter, and logs security audit events.

---

Requirements & Context

• Secure, tested, and documented: AES-256-GCM column encryption with versioned KMS key generations.
• Resumable Batch State: Persisted rotation state table (kms_rotation_state) tracks batch cursor and status across service restarts.
• Crash Mid-Batch Safety: Re-encryption queries filter rows where key_generation < target_key_generation, preventing double re-encryption if process crashes mid-batch.
• Metrics: Emits rotation.rows_reencrypted counter metric via MetricsCollector.
• Audit Log: Emits security audit events for job start, batch progress, completion, and failures.

---

Detailed Changes

Security & Rotator Service

• src/security/kmsKeyProvider.ts: KMSKeyProvider interface and LocalKMSKeyProvider implementing AES-256-GCM column encryption tagged with key generation IDs (keyGeneration) and key rotation support (rotateKey()).
• src/security/columnEncryptionRotator.ts: ColumnEncryptionRotator service managing background column re-encryption jobs:
  • startRotation(targetTable, targetColumn, options)
  • processBatch(jobId, batchSize)
  • resumePendingRotations(batchSize)
  • Emits rotation.rows_reencrypted metric counter.
  • Logs KEY_ROTATION audit events.
• src/security/types.ts: Added KMSRotationJobState, KMSRotationOptions interfaces and added 'KEY_ROTATION' event type to AuditEvent.
• src/security/index.ts: Re-exported KMS encryption primitives and rotator service.

Database Migration

• src/db/migrations/020_create_kms_rotation_state.sql: Added database migration for kms_rotation_state persistence table and kms_sample_records demonstration table.

Unit & Integration Tests

• src/security/columnEncryptionRotator.test.ts: Comprehensive test suite testing KMS key rotation, batch re-encryption, crash mid-batch resumption without double re-encryption, metric counter emission, and audit log generation.
• package.json: Added test:kms-rotation test script.