Add a health surface via hook_requirements (Status Report)

Summary

pdv has no operator-facing health surface today: no hook_requirements, nothing on the Status Report. Add point-in-time health checks so an operator can see at a glance whether the vault can function. This is dependency-free (it uses core Status Report) and is the foundation the optional monitoring integration builds on.

Checks to surface

• Master KEK reachable and valid (ERROR if not): the configured pdv.settings:master_key_id resolves in the key repository, the backend is reachable, and the key is 32 bytes. Without it the vault cannot seal or unseal anything. Mirrors the conditions SubjectKeyManager already enforces (it throws KekException for a missing master_key_id, a key not found in the repository, or a key that is not 32 bytes).
• Vault storage writable (ERROR if not): the private file location pdv writes documents to exists and is writable. Same instinct as the webdav lock-store Status Report check.
• Expired-row backlog bounded (WARNING above a threshold): the count of open or expired pdv_grant_request rows, and whether the GarbageCollector sweep is keeping them bounded. A large or growing backlog means the sweep is not running or is falling behind.
• Master KEK rotation not stalled (WARNING): after a rotation, the number of subjects still wrapped under an old Master KEK (MasterKeyRotator state). Non-zero for a long time means a rotation never finished.

Constraints

• No PII, no key material, and no user identifiers in any requirement value or message; report only booleans and aggregate counts.
• Checks must be cheap, since the Status Report runs them synchronously. The KEK check must not decrypt anything, only confirm the key resolves and has the right length.

Tests

• A missing, short, or unreachable Master KEK yields an ERROR requirement.
• An unwritable storage location yields an ERROR.
• A backlog over the threshold yields a WARNING; under it, OK.
• Requirement messages contain no uid, key bytes, or document content.