feat(kms): add multi-instance MPC key provider

[kvinwang]

Summary

• add a stable MPC key-provider identity committing to the threshold P-256 CA, K-256 signing key, P-256 derivation key, protocol version, and cluster ID
• add attested, replay-resistant member transport and CGGMP21 threshold DKG/signing across multiple KMS instances
• add verifiable threshold key derivation, threshold-issued root/RPC certificates, and manifest-bound node evidence
• add recoverable genesis, epoch activation, revocation/subset resharing, and threshold-authorized member join flows
• prevent rollback, skipped epochs, same-epoch forks, concurrent authorization forks, and legacy full-root onboarding/export in MPC mode
• document deployment, lifecycle, migration, recovery, and operational requirements

Identity chain

The measured workload pins key_provider_id. GetMeta exposes the committed group public keys, threshold-signed epoch manifest, and local node evidence. The manifest binds each member's endpoint, quote-bound RA-TLS key, and public-share commitment. The live TEE quote then proves possession of the authorized TLS key.

No MPC member loads, reconstructs, or exports a complete root private key.

Verification

• cargo test -p dstack-kms --no-fail-fast — 58 passed
• cargo test -p ra-tls --no-fail-fast — 16 passed
• cargo check --workspace
• cargo check -p dstack-kms after rebasing onto current master
• git diff --check

The long KMS integration test executes real CGGMP 3-of-5 K-256 and P-256 threshold operations with two nodes offline and verifies the externally assembled root certificate.

Deployment note

A new MPC genesis rotates key_provider_id and derived application keys. Existing encrypted disks require an application-level migration; this PR intentionally provides no API that reconstructs or imports a complete root key.

Remaining validation

• run a deployment-level multi-CVM genesis/join/revoke ceremony with production networking and supervisor restart behavior before removing draft status