feat(kms): add backend capability discovery

Add BackendCapabilities and a KmsBackend::capabilities() method with a
conservative default so callers can discover which lifecycle operations
the active backend supports instead of probing them. Each backend
declares its real matrix (Vault Transit is the only one advertising
version-retaining rotation). Introduce the typed
KmsError::UnsupportedCapability variant for later use by lifecycle
endpoints.

Refs rustfs/backlog#1571 (part of rustfs/backlog#1562)

crates/kms/src/error.rs

@@ -128,6 +128,10 @@ pub enum KmsError {
     /// Backup/restore bundle contract violation; see [`crate::backup::BackupError`]
     #[error(transparent)]
     Backup(#[from] crate::backup::BackupError),
+
+    /// Operation is not supported by the active KMS backend
+    #[error("Operation '{operation}' is not supported by KMS backend '{backend}'")]
+    UnsupportedCapability { backend: String, operation: String },
 }
 
 impl KmsError {
@@ -269,6 +273,14 @@ impl KmsError {
             version,
         }
     }
+
+    /// Create an unsupported capability error
+    pub fn unsupported_capability<S1: Into<String>, S2: Into<String>>(backend: S1, operation: S2) -> Self {
+        Self::UnsupportedCapability {
+            backend: backend.into(),
+            operation: operation.into(),
+        }
+    }
 }
 
 /// Convert from standard library errors