feat(vault): version-indexed encryption key paths, CURRENT_KEY_VERSION=2, rotate method (ADR-021)

- Bump CURRENT_KEY_VERSION from 1 to 2 (v1 reserved for TS PBKDF2 legacy per ADR-020)
- Add derivation::encryption_path_for_version(version) -> m/74'/2'/0'/{version-2}', returns InvalidPath for version < 2
- Add VaultServiceHandle::derive_encryption_key_for_version(version), cached by path, returns InvalidPath for version < 2
- encrypt/decrypt now derive at encryption_path_for_version(key_version) instead of fixed PATHS::ENCRYPTION
- Add VaultServiceHandle::rotate(encrypted, to_version): decrypt old, re-encrypt new
- Update existing tests to use v2; add round-trip, rotation, partial-rotation, and invalid-version tests

Task: vault/key-versioning-rotation

crates/alknet-vault/tests/service_tests.rs

@@ -76,7 +76,7 @@ fn test_encrypt_decrypt_lifecycle() {
     service.unlock_new(24).unwrap();
 
     let plaintext = "my-api-key-12345";
-    let encrypted = service.encrypt(plaintext, 1).unwrap();
+    let encrypted = service.encrypt(plaintext, 2).unwrap();
     let decrypted = service.decrypt(&encrypted).unwrap();
     assert_eq!(decrypted, plaintext);