P2: KMS key material leak and missing encryption context #669

Summary

Bugs

• Key material never rotated: EnableKeyRotation / DisableKeyRotation defined but don't actually rotate keys.
• Encryption context not used: AAD set to keyID only — custom encryption context from API ignored.

Memory Leaks

• Key deletion doesn't purge key material: keyMaterials map entry never deleted after deletion period.

Missing Features

• ImportKeyMaterial / DeleteImportedKeyMaterial
• Custom key stores
• Multi-region key replication
• Key policy enforcement (stored but never enforced)
• Grant constraint validation

Files

• services/kms/backend.go