feat: console tenant events SSE and KMS environment alignment

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

N/A

Summary of Changes

This PR contains two commits on the fork main branch:

1. KMS / encryption: Align RustFS KMS pod environment variables with the RustFS server and rustfs-kms; remove Vault TLS fields that were not wired to rustfs-kms; validate local KMS keyDirectory (absolute path, single replica across pools); run KMS Secret validation whenever spec.encryption.enabled is true.

2. Console tenant events (breaking): Remove GET /api/v1/namespaces/{namespace}/tenants/{tenant}/events. Deliver events via SSE at GET .../tenants/{tenant}/events/stream (text/event-stream; each data: line is JSON EventListResponse). Server-side discovery aggregates core/v1 Events for the Tenant CR, Pods, StatefulSets, and PVCs in scope (rustfs.tenant / pool naming), with merge, dedupe, sort, and cap. The first snapshot is built before the SSE response is committed so clients receive a proper HTTP error if listing fails. The tenant detail Events tab uses EventSource with the same session cookie as other console API calls.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests (tenant_event_scope unit tests)
• Documentation updated (if needed) — user-facing API described in CHANGELOG.md under [Unreleased]
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility) — Console HTTP API: the REST events list endpoint is removed; clients must use the SSE stream.
• Requires doc/config/deployment update — any automation or scripts calling the old GET .../events path must be updated.
• Other impact: N/A

Verification

make pre-commit
cargo test --all

Additional Notes

N/A

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.