Issue #3594568: Reorganize vault action buttons and add row batch actions

Reorganizes the vault overview and adds row batch actions, plus the redirect/ceremony fixes found while testing.

What

• Each section's action buttons (Add a file, Grant access, Add trusted consumer, per-kind record adds) move below their table.
• A checkbox per row with a per-section batch button: Delete selected (Files / Structured data), Revoke selected (Active grants), Stop trusting (Consumer access), Decline selected (Access / Store requests). Approve stays per-row (it is an individual review). Each batch button reuses the existing single-entity confirm form, made multi-value via an ids query.
• Empty sections show just their action; no-action empty sections keep their "nothing here" table.

Redirect / ceremony fixes

• Vault-page actions (per-row + batch) return to the vault instead of bouncing to a consumer return_url; a real live ceremony still bounces back to its form (a from=vault signal).
• Cancelling a ceremony deletes the request it started, so it neither clutters the vault nor blocks a restart.
• Read ceremonies no longer auto-generate a document_uuid, so openCeremony() replaces an abandoned ceremony on restart instead of conflicting.

Tests

New kernel coverage: per batch action, single-entity path intact, selection->ids mapping, no-op on empty selection, ceremony cancel deletes + returns, read ceremony has no document_uuid, restart overrides. phpcs + phpstan clean; ConsentFlow / GrantFlow / Preauthorization suites still pass.