build-104

M3 Follow-up Pack (FR#3504 + FR#3517)

Post-release tightening of the M3 bundle shipped in build-103.

• FR#3504-#1 HandleUpdateKey now clears last_warned_stage when the role-change renews expires_at, preventing silent suppression of key-expiry warnings in the new cycle.
• FR#3517-#2 Admin-rotate-foreign-key: the key owner now receives an urgent key_rotated_by_admin agent message (plaintext key is admin-only — owner collects via pre-agreed secure channel).
• FR#3517-#1 New X-Key-Grace-Expires-In HTTP response header during the 24h grace-period (replaces X-Key-Expires-In which would otherwise be negative).
• FR#3517-#4 Rotation rollback-failure is no longer silent — mlWarning is logged with the inner exception for ops visibility.
• FR#3504-#3 Spec#3194 §I3 erratum (table-name drift developers.last_warned_stage → client_keys.last_warned_stage; code was always correct).

Checker-pass: 1 CRIT + 4 WARN inline-fixed pre-ship (HAVING FK-guard, full JSON escape chain, grace boundary inclusive).

Still open: FR#3517-#3/#5/#6 + FR#3504-#2 (timer-promotion) — tracked for a future release.