[BOUNTY] TOFU Key Revocation and Rotation — 15 RTC

[dannamax]

Fixes #308

This PR implements a complete TOFU (Trust-On-First-Use) key management system for RustChain attestation with:

✅ Key Features:

• Admin endpoint to revoke compromised keys
• Agent endpoint to rotate their own keys (requires signing with current key)
• Revoked keys immediately rejected on all endpoints
• Rotation creates audit trail (old key → new key, timestamp)
• Storage extends existing nonce/TOFU SQLite storage

✅ Implementation Details:

• Inline implementation: Directly integrated into existing attestation flow (no separate modules)
• Non-destructive: Only adds functionality, preserves all existing code
• Complete testing: Full integration test suite included
• Proper error handling: Appropriate HTTP status codes and user-friendly messages
• Security hardened: Ed25519 signature verification with pynacl

✅ Maintenance Feedback Addressed:

• TOFU table initialization moved to startup (not per-request)
• Proper comment indentation (4 spaces, matches surrounding code)
• No incorrect dependency declarations in pyproject.toml
• Clean code formatting with no extra blank lines

✅ Design Compliance:

• Works without central CA (peer-to-peer trust model)
• Atomic key rotation (no window where both old and new keys work)
• Follows BS2.0 quality principles: inline-first, non-destructive, single-purpose

This is a resubmission of PR #329 with all maintainer feedback addressed. The previous PR was closed but the maintainer indicated this could be resubmitted later.

---

Testing: All integration tests pass locally. The implementation follows the exact pattern used in successful PRs #335, #336, and #337.