BYOK — Bring your own KEK

Per-tenant key-encryption-key configuration. Backed by AWS KMS, GCP KMS, Azure Key Vault, or VeritasIQ Vault. Verify lives in this UI so the BYOK customer can prove their key is in use without a VeritasIQ engineer on the call. Rotation runbook: docs/runbooks/byok-key-rotation.md.