feat(pki): reconcile recovered signing operations

Add bounded durable reconciliation with retry metadata, fencing-safe
status and cancellation handling, and server-managed background recovery.

Include versioned persistence migration, bounded keyset paging, lifecycle-safe
worker shutdown, redacted diagnostics, and restart/failure coverage.

Closes #10

docs/pki-server-trusted-proxy-nginx-example.json

@@ -1,5 +1,5 @@
 {
-  "version": 5,
+  "version": 6,
   "serverName": "zeroecho-admin-nginx",
   "realm": {
     "realmId": "production",
@@ -40,6 +40,7 @@
     "maximumForwardedChainBytes": 524288
   },
   "execution": {"transportWorkers":8,"transportQueueCapacity":64,"operationWorkers":4,"operationQueueCapacity":32,"maximumAdmittedRequests":96,"defaultDeadlineMillis":30000,"maximumDeadlineMillis":120000,"gracefulShutdownMillis":30000,"forcedShutdownMillis":10000},
+  "signingReconciliation": {"enabled":true,"maxRecords":256,"maxCalls":64,"passTimeoutMillis":30000,"providerCallTimeoutMillis":10000,"idleIntervalMillis":2000},
   "publicListener": {"enabled":false},
   "acmeListener": {"enabled":false},
   "runtime": {}