Provide local environment mirroring Datev file-based deployment to observe and validate rotation logs

## Objective

Configure a reproducible local testing environment mirroring the enterprise Datev deployment topology (filesystem-mounted token signing keys, certificate chains, and database password files with `FileWatcher` enabled) and provide automated tooling to trigger, observe, and validate credential and certificate hot-rotation logs in the running server.

## Context

In Datev environments, secrets are not fetched via cloud provider APIs; rather, they are mounted as files into the container filesystem from Kubernetes secrets or external secret stores.

The server utilizes `FileWatcher` (`src/utils/file_watcher.rs` and `src/setup.rs`) to detect on-disk changes to:
- Token signing keys (`server.cert.store.signing_key_path`)
- X.509 certificate chains (`server.cert.store.certificate_path`)
- Database password files (`database.password_file`)

When files are replaced or updated, the server performs zero-downtime hot-reloading and emits structured tracing logs (`rotation_started`, `rotation_succeeded`, `rotation_failed`, `file_watcher_path_unavailable`).

To guarantee operational reliability for enterprise deployments, we need a local sandbox environment and validation harness that simulates real-world volume rotations and asserts that the server processes rotations smoothly without dropping traffic or crashing.

## Deliverables

- [ ] **Datev-Mirrored Local Environment**:
- Add a dedicated Docker Compose configuration or profile (`docker-compose.datev.yml` or within `deploy/compose/`) configured with:
- Filesystem-based token signing key and certificate mounts.
- Filesystem-based database password (`APP_DATABASE__PASSWORD_FILE`).
- Configured `FileWatcher` polling interval and debouncing.
- [ ] **Automated Rotation Test & Verification Script**:
- Implement a runnable script (`scripts/test-datev-rotation.sh`) that:
1. Boots the server with initial certificates and signing key.
2. Issues a status list token and records the signature key ID / certificate fingerprint.
3. Simulates secret rotation by atomically updating the mounted key and certificate files.
4. Observes and captures server logs to verify `rotation_started` and `rotation_succeeded` events are emitted.
5. Issues a new token and asserts that the new key/certificate are actively used.
6. Simulates invalid file injection (e.g. malformed PEM or corrupt database credentials) and verifies `rotation_failed` is logged while the previous valid credentials remain active (fail-safe).
- [ ] **Operational Runbook Documentation**:
- Document the Datev local environment setup and rotation observation procedures in `docs/deployment-runbook.md` and `docs/troubleshooting.md`.

## Acceptance Criteria

- [ ] The local Datev environment starts with a single command without external cloud dependencies.
- [ ] Rotating files on disk triggers immediate hot-reload logs (`rotation_started` -> `rotation_succeeded`) without process restart.
- [ ] Injected errors are logged as `rotation_failed` without crashing the server.
- [ ] New status list requests immediately use the rotated keys.

## References

- Sub-EPIC: #503 (Sprint 3: Vendor-Neutral Deployment, Multi-Database Support & Performance Validation)
- Baseline EPIC: #141 (Status List Server Hardening & Production Readiness)
- Implementation: `src/utils/file_watcher.rs`, `src/setup.rs`