feat(admin): expose KMS backup and restore behind explicit guards (#5579)

* feat(kms): add backup and restore admin API

Wires the merged KMS backup contract, Local export and Local restore into
the admin API: export a sealed bundle, run a zero-write restore preflight,
execute a confirmed restore, roll an interrupted restore back, and report
subsystem readiness.

- Dedicated kms:Backup / kms:Restore actions, recorded in the admin route
  matrix. Neither is reachable through any other KMS action.
- Restore requires two independent confirmations: an echo of the bundle
  manifest's backup id, and an explicitly named conflict policy (the
  default never writes).
- The backup KEK comes from the environment and is refused when it reuses
  a secret of the configured backend, compared both as the literal value
  and as raw key bytes.
- No endpoint accepts a path: bundles are addressed by a validated name
  under a configured root, and the restore target is always the server's
  own configured key directory.
- Bundles now carry a sanitized configuration artifact built as an
  allowlist projection, so a future backend credential field cannot leak
  into a bundle by default. Restore verifies it and never applies it.
- Audit entries go through the existing KMS admin wiring and carry
  identifiers only.

* test(kms): pin the backup admin API gates

Fixes the test KEK to a real 32-byte value and drives the export refusal
from the configured backend rather than from the handle that happens to
be available, so a Local handle cannot export on behalf of a backend
whose material RustFS does not own.

crates/kms/src/manager.rs

@@ -448,6 +448,15 @@ impl KmsManager {
     pub(crate) fn backend(&self) -> Arc<dyn KmsBackend> {
         self.backend.clone()
     }
+
+    /// The running client a full-material backup can be exported from, or
+    /// `None` for backends whose cryptographic root lives outside RustFS.
+    ///
+    /// See [`KmsBackend::local_backup_client`] for why the export must use the
+    /// running client rather than a freshly opened one.
+    pub fn local_backup_client(&self) -> Option<&crate::backends::local::LocalKmsClient> {
+        self.backend.local_backup_client()
+    }
 }
 
 #[cfg(test)]