[auto-rotation feature] PR 3 - Auto-rotation scheduler + deadline detection

[Manuthor]

Summary

Adds a background cron scheduler that automatically rotates keys whose x-rotate-interval
has elapsed, with configurable check frequency via a new server flag.

This is PR 3 of 4 in the key auto-rotation feature stack (depends on PR 2: #988):

develop
  ← PR 1  docs/key-autorotation-spec          (#968)
  ← PR 2  feat/key-rotation-ckms-ui            (#988)
  ← PR 3  feat/key-rotation-scheduler          ← this PR (#970)
  ← PR 4  feat/key-rotation-notifications      (#971)

What's included

Database — find_due_for_rotation()

New ObjectsStore method returns all Active symmetric/private keys whose
rotation deadline has passed:

deadline = x-rotate-date + x-rotate-interval   (for previously-rotated keys)
deadline = Initial Date + x-rotate-offset       (for never-rotated keys)

Implemented in SQLite, PostgreSQL, and MySQL backends.

Auto-rotation dispatcher — crate/server/src/core/auto_rotate.rs

• run_auto_rotation(kms, owner) — iterates due keys and dispatches to the
  correct rotation flow (plain, wrapping, wrapped, asymmetric)
• dispatch_renewal_warnings(kms) — emits approaching-deadline events at 30
  / 7 / 1 days before next rotation (wired by PR 4 ([auto-rotation feature] PR 4 - Notification system (SMTP email) #971) notifications)
• OTel counter kms.key.auto_rotation labelled with uid and algorithm
  on every successful rotation

Cron thread — crate/server/src/cron.rs

• start_auto_rotation_cron() spawns a Tokio task that wakes every
  check_interval_secs and calls run_auto_rotation()
• Graceful shutdown via cancellation token

Server config

• New flag --auto-rotation-check-interval-secs (default 0 = disabled)
• Corresponding wizard step in crate/server/src/config/wizard/auto_rotation_wizard.rs
• kms.toml template updated

Configuration example

cosmian_kms --auto-rotation-check-interval-secs 300   # check every 5 minutes

Or in kms.toml:

auto_rotation_check_interval_secs = 300

Breaking changes

None. The scheduler is off by default (0 disables it).

Reviewer notes

• dispatch_renewal_warnings uses the Notifier trait wired in PR 4 ([auto-rotation feature] PR 4 - Notification system (SMTP email) #971) to
  send SMTP alerts at 30 / 7 / 1 days before the next scheduled rotation.
• HSM-resident keys (UID prefix hsm::) are excluded from
  find_due_for_rotation — the KMS cannot generate key material inside the HSM.