feat!: replace dead key-rotation machinery with keyring decrypt helper (LAB-683)

Deletes the rotation dead code the LAB-275 audit flagged as a trust bug and
implements the cachekit-core half of the keyring decision
(protocol/decisions/key-rotation.md, merged via protocol#34):

- Remove ZeroKnowledgeEncryptor::rotate_key() NotImplemented stub and the
  EncryptionError::NotImplemented variant
- Delete src/encryption/key_rotation.rs whole (KeyRotationState,
  RotationAwareHeader) and the EncryptionHeader alias + re-exports
- Add encryption::keyring::Keyring: one current master key + at most 3
  decrypt-only keys; sequential decrypt current-first with identical AAD per
  attempt; per-entry HKDF-derived encryption-key fingerprints for
  fingerprint-based selection; cap and forward-only self-collision rejected at
  construction; all key material zeroized on drop

BREAKING CHANGE: public items EncryptionHeader, KeyRotationState,
RotationAwareHeader, and ZeroKnowledgeEncryptor::rotate_key() are removed
(EncryptionError::NotImplemented variant included). Use Keyring for
master-key rotation.

Author: 27Bslash6

README.md

@@ -215,7 +215,7 @@ gcc -o example example.c -L target/release -lcachekit_core -I include
 │  Each tenant key provides:                                       │
 │  • Cryptographic isolation (compromise one ≠ compromise all)    │
 │  • Domain separation (cache vs auth vs sessions)                │
-│  • Forward secrecy with key rotation                            │
+│  • Master-key rotation via decrypt-only keyring (grace window)  │
 │                                                                  │
 └─────────────────────────────────────────────────────────────────┘
 ```
@@ -263,7 +263,7 @@ cachekit-core/
 │   │   ├── mod.rs          # Module exports
 │   │   ├── core.rs         # AES-256-GCM implementation
 │   │   ├── key_derivation.rs # HKDF-SHA256 + tenant isolation
-│   │   └── key_rotation.rs # Graceful key rotation support
+│   │   └── keyring.rs      # Multi-key decrypt keyring (master-key rotation)
 │   │
 │   └── ffi/                # (feature = "ffi")
 │       ├── mod.rs          # FFI exports

src/encryption/core.rs

@@ -154,8 +154,19 @@ pub enum EncryptionError {
     #[error("Nonce counter exhausted - key rotation required")]
     NonceCounterExhausted,
 
-    #[error("Key rotation not yet implemented")]
-    NotImplemented(String),
+    #[error("Invalid master key length: expected at least 16 bytes, got {0}")]
+    InvalidMasterKeyLength(usize),
+
+    #[error(
+        "Keyring cap exceeded: at most {max} decrypt-only keys allowed, got {0}",
+        max = super::keyring::MAX_DECRYPT_ONLY_KEYS
+    )]
+    KeyringCapExceeded(usize),
+
+    #[error(
+        "Current key must not appear in the decrypt-only list (forward-only rotation invariant)"
+    )]
+    CurrentKeyInDecryptOnlyList,
 }
 
 /// Zero-knowledge encryptor using AES-256-GCM with hardware acceleration detection
@@ -480,22 +491,6 @@ impl ZeroKnowledgeEncryptor {
             .unwrap_or_else(|_| OperationMetrics::new())
     }
 
-    /// Key rotation API (stub for future implementation)
-    ///
-    /// This method will support gradual key migration to allow rotating encryption keys
-    /// without downtime. Future implementation will:
-    /// - Support dual-key mode (read from both old and new key, write with new key only)
-    /// - Add version byte to ciphertext header indicating which key was used
-    /// - Implement gradual migration strategy
-    ///
-    /// Currently returns NotImplemented error.
-    pub fn rotate_key(&mut self, _new_master_key: &[u8]) -> Result<(), EncryptionError> {
-        Err(EncryptionError::NotImplemented(
-            "Key rotation will be implemented in a future release with gradual migration support"
-                .into(),
-        ))
-    }
-
     /// Encrypt data using AES-256-GCM with authenticated additional data (wasm32)
     ///
     /// Uses RustCrypto's `aes-gcm` crate (pure Rust, compiles on wasm32-unknown-unknown).