Provision Confirm

Confirm or discard pending storage-passphrase rotations from POST /provision.

Delegates to the same shared logic as the legacy /luks/confirm (process_luks_confirm): require_confirm_nonce validates and consumes the nonce, then volumes with rotated=True have pending passphrases promoted to current and rotated=False discards pending.