Confirm Luks Rotation

Confirm or discard pending LUKS passphrase rotation results.

DEPRECATED for the storage-rotation flow: new VMs use POST /provision/confirm (same shared logic). Kept for legacy in-field VMs; note the boot-phase root-passphrase confirm still uses this route until /luks/* is fully retired.

The VM reports per-volume success/failure. require_confirm_nonce validates and consumes the nonce before the handler runs. Volumes with rotated=True have pending passphrases promoted to current; rotated=False discards pending.