Move the 7-30 day pending-deletion window check to KmsManager::delete_key so
every admin-facing deletion is validated once, before any backend runs, and
refuse `force_immediate` unless the server opts in through the new
`allow_immediate_deletion` config gate and the request echoes the key id back
in `confirm_key_id`.
The backends keep the same window bound as a defensive assertion for callers
that hold a backend handle directly, now expressed with the shared constants.
overtrue
fba546deb0