Operator subjects report and purge are not tenant-aware

The operator tools under /admin/config/pdv/subjects were written before multi-tenancy (#3593589) and do not account for the tenant partition:

• The report (SubjectsController) queries pdv_subject_key and pdv_item directly with no tenant condition, so it mixes subjects from every tenant into one list.
• It judges each subject's key against the single site Master KEK (pdv.settings:master_key_id), so a subject legitimately wrapped under a per-tenant key is mislabeled as not on the current Master KEK.
• The per-subject purge goes through SubjectKeyManager, which now scopes by the resolved tenant (the default tenant in an operator context). So the report can show a subject that exists in several tenants, but purging it only erases the default tenant's key and leaves the other tenants' vaults intact, with no indication to the operator.

Proposed fix:

• add a tenant filter (a select) to the report, defaulting to the default tenant, and show the tenant column when more than one tenant exists;
• scope the listing, the access inspection, and the purge to the selected tenant;
• judge each subject's key against its own tenant's Master KEK rather than the site key (lines up with the rotation fix in #3593719).

Single-tenant installs are unaffected.