Add Key Vault expiration reminders and secret rotation telemetry

[Bionic711]

Summary

Fixes #1156

Adds Key Vault expiration reminder tracking and reliable Key Vault-backed secret rotation across action scopes.

• Adds a SimpleChat-managed Key Vault secret reminder inventory, admin dashboard, manual sweep API, and background sweep.
• Adds per-action reminder metadata controls for expiration date, lead days, contact email, label, and rotation notes.
• Fixes global, group, and personal action secret rotation so replacing a Key Vault-backed secret writes a new Key Vault secret version instead of preserving the old value.
• Adds privacy-safe Application Insights telemetry for external Azure Monitor automation, with a default-off admin opt-in for emitting reminder contact email.
• Adds key_vault_secret_expiring in-app notifications, feature/fix documentation, release notes, and focused regression/UI tests.

Validation

• git --no-pager diff --check
• python -m py_compile for changed Python files
• node --check application\single_app\static\js\admin\admin_settings.js
• node --check application\single_app\static\js\plugin_modal_stepper.js
• python functional_tests\test_keyvault_external_notification_telemetry.py
• $env:PYTHONUTF8='1'; python functional_tests\test_sql_plugin_key_vault_secret_storage.py
• python functional_tests\test_keyvault_plugin_secret_scope_enforcement.py
• python functional_tests\test_model_endpoints_key_vault_secret_storage.py
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py
• python functional_tests\route_tests\test_route_policy_test_coverage.py
• python scripts\check_swagger_routes.py application\single_app\route_backend_plugins.py application\single_app\route_backend_settings.py application\single_app\route_frontend_admin_settings.py
• python scripts\check_xss_sinks.py --base-sha origin/Development --head-sha HEAD <changed application browser files>
• python scripts\check_broken_access_control.py --base-sha origin/Development --head-sha HEAD <changed application Python files>
• python -m pytest ui_tests\test_admin_key_vault_reminders_ui.py -q

Release Notes and Documentation

• Version bumped to 0.250.123.
• Release notes updated under v0.250.121, v0.250.122, and v0.250.123.
• Feature documentation added: docs/explanation/features/KEY_VAULT_EXPIRATION_REMINDERS.md
• Fix documentation added: docs/explanation/fixes/KEY_VAULT_SECRET_ROTATION_FIX.md

Known Risks / Follow-up

• SimpleChat emits in-app notifications and Application Insights telemetry, but external email delivery still depends on an admin-configured Azure Monitor alert/action group, Logic App, Function, or webhook.
• Reminder contact email is excluded from telemetry by default and only emitted when admins explicitly enable the new opt-in setting.
• Changed-line XSS and broken-access-control scans pass. A full-file XSS scan of the already-large touched UI files still reports pre-existing legacy sink patterns outside the new Key Vault reminder hunks.