Issue #3594105: Pre-release audit fixes (AAD tenant binding, cross-key rotation, scale hardening)

Fixes for https://www.drupal.org/project/pdv/issues/3594105 . See the issue summary for the grouped list of correctness and scalability fixes. Verified with phpcs, phpstan (level 1), and the kernel suite (177 tests).