Fix: CMK initialization race condition on concurrent server startup

### Problem

When multiple server instances start simultaneously for the first time, a TOCTOU (Time-of-Check-Time-of-Use) race condition exists in the CMK initialization flow.

The current flow is:

1. `DescribeKey(alias/my-key)` → not found
2. `CreateKey()` → new key ID
3. `CreateAlias(alias/my-key, key_id)`

If N instances all reach step 1 before any instance completes step 3, each instance creates its own CMK. Only one will win the `CreateAlias` call; the remaining N−1 keys become orphaned.

### Acceptance Criteria

- [ ] On concurrent first-launch, exactly one CMK is created and aliased
- [ ] Losing instances successfully resolve and use the winning key via a follow-up
`DescribeKey` call
- [ ] Integration test covering the race scenario