feat(rc-admin)!: add safe RustFS KMS key lifecycle mutations

[cxymds]

Related issues

Resolves rustfs/backlog#1395
Part of rustfs/backlog#1378
Roadmap: rustfs/backlog#1361

Background

After read-only KMS inspection in #278, RustFS administrators need explicit key lifecycle mutations that use the native beta.10 Admin API without exposing key material. Deletion must remain non-accidental, and inconsistent server error payloads must not leak into CLI diagnostics.

This PR is stacked on #278 so the mutation surface remains independently reviewable.

Solution

• add rc admin kms key create ALIAS [--name] [--description] [--tag KEY=VALUE]
• add scheduled deletion with a 7-30 day window and mandatory --yes
• add immediate deletion requiring both --yes and --confirm-immediate
• add rc admin kms key cancel-deletion ALIAS KEY_ID
• use native RustFS routes for create, delete, and cancellation
• validate duplicate/reserved tags and reject control characters
• add typed output-v3 results for create, delete, and cancellation
• classify permission, missing-key, conflict, unavailable, rejected, and malformed responses without echoing server response bodies or unknown key-material fields
• add command parser, transport, integration, schema, and documentation coverage

Security

The CLI never calls a data-key generation/export route. Request diagnostics do not include mutation bodies, and response adapters select only known metadata fields. Immediate deletion has a second explicit acknowledgement because it cannot be cancelled.

Compatibility

BREAKING contract marker: this extends the protected CLI reference and output-v3 KMS contract with lifecycle mutation operations. Existing output-v1 and output-v2 contracts remain unchanged.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• focused S3 KMS tests: 11 passed
• CLI KMS integration tests: 11 passed
• output-v3 schema tests: 6 passed

All checks pass locally. Native route and request contracts are covered with signed mock Admin servers; a live configured-KMS environment is still recommended before merge.

[cxymds]

Validation is complete for commit 0a018374dd1f1085d73b9ac53f1cc2d4d20cb58c.

• CI: passed
• Integration Tests: passed
• Local: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace passed

The PR base has been restored to cxymds/issue-1394-kms-inspection after triggering the stacked-PR workflows.