Issue #3593601: track per-vault last activity (dormancy foundation)

Add a last_activity timestamp to pdv_subject_key (the per-(tenant, owner) vault row) and an index for the dormancy scan. SubjectKeyManager::touch() records activity, throttled, scoped to one tenant or all of an owner's vaults; Vault::recordActivity() exposes it. Activity is recorded on owner login and vault-page access (all the owner's vaults, since a browsing connection cannot yet be attributed to one realm) and on any vault read, store or update (the current realm only -- covers consumer reads/writes, since live data is in-use data). Lifecycle warn/erase comes next.

Closes #3593601