docs(kms): correct the KV2 at-rest boundary and rotation rejection claims

The Vault KV2 section claimed the backend reports its confidentiality
boundary as `at_rest_protection: vault-kv2-acl` through `backend_info`.
That accessor, the `BackendInfo` type and its assertion test were removed
in rustfs/rustfs#5501, and no replacement reports the boundary. State
instead that the boundary is documented only, that `kms/status` exposes a
capability matrix covering supported operations rather than key-material
location, and that the backup manifest's `at_rest_protection` field is a
bundle declaration rather than a backend self-report.

The rotation section named `InvalidOperation` as the error Local and
Static return. Neither advertises `rotate`, so the product path falls to
the shared `KmsBackend` default and returns `UnsupportedCapability`;
`InvalidOperation` survives only in a test-only client helper.

crates/kms/src/backup/capability.rs

@@ -65,9 +65,10 @@ pub enum AtRestProtection {
     /// for bundling purposes: re-wrap is mandatory.
     LegacyUnspecified,
     /// Vault KV2 as currently shipped: material confidentiality relies on
-    /// Vault ACLs, KV2 at-rest encryption, and TLS only (the backend reports
-    /// `at_rest_protection = "vault-kv2-acl"`); RustFS applies no
-    /// cryptographic wrapping of its own.
+    /// Vault ACLs, KV2 at-rest encryption, and TLS only; RustFS applies no
+    /// cryptographic wrapping of its own. The backend reports nothing about
+    /// that boundary at runtime, so this value is a backup-manifest
+    /// declaration, not a backend self-report.
     StorageOnly,
     /// Vault KV2 with material wrapped by Vault Transit before storage. Not
     /// produced by any current backend; the row exists so a future direction