Pre-release audit fixes: tenant-bound Subject KEK AAD, cross-key Master KEK rotation, and 100k/500k scalability hardening

A full pre-release audit of the module (core plus submodules) surfaced a set of correctness and scalability issues. This issue collects the fixes. All are verified with phpcs, phpstan, and the kernel test suite.

Security / correctness

• Cross-key Master KEK rotation: SubjectKeyManager::rewrapUnder() treated any two keys sharing a wrap plugin (same Key type) as an in-place native rewrap, so two distinct OpenBao/Vault Transit keys would feed the source-key ciphertext to the target key. A Master KEK id change now unwraps with the source key and re-wraps with the target; only a same-id version advance uses the native rewrap. Regression test added.
• Tenant-bound Subject KEK AAD: the additional authenticated data wrapping a Subject KEK omitted the tenant, so two tenants sharing one Master KEK had interchangeable wrapped Subject KEKs. The AAD now binds tenant and owner.
• Dormancy trust cleanup: a dormancy crypto-erase left the owner per-kind trust rows behind with no reaper to reclaim them while the account stayed alive. The erase now drops them once the owner last vault in any tenant is gone.
• Composer packaging: the pdv_vault submodule was missing from the root composer.json replace block.

Scalability (100k subjects, 500k items)

• Dormancy preview: loaded every at-risk subject entity to compute two totals; it now counts in SQL on the indexed activity column.
• Missing indexes: added indexes on pdv_grant.expires_at, pdv_consumer_authorization.expires_at, and pdv_grant_request.created, which the garbage-collector reapers and status-report counts all filter on.
• Rotation batch load: rewrapBatch() re-loaded each subject row one by one; it now loads the whole chunk in a single query.
• Export streaming: the vault export re-unwrapped the owner Subject KEK once per item; it now unwraps once per owner and streams one plaintext body at a time into the archive, so memory stays flat.

No update hooks are added: the project is alpha, so the new indexes ship in hook_install (fresh install only).