File watcher triggers spurious credential rotation on read/open events (rotation spam)

## Objective

The file watcher reacts to `IN_OPEN`/access events emitted by the application's own reads of watched secret files, producing a self-sustaining rotation loop that spams logs and reconnects to the database roughly every 500ms even when no key rotation occurs. Make the watcher robust so it only reacts to genuine content changes, regardless of the event source.

## Deliverables

- A robust change-detection mechanism in `src/utils/file_watcher.rs` that verifies the watched file's content actually changed (e.g. content fingerprinting) before dispatching the rotation callback, rather than relying solely on event kinds.
- Unit tests covering spurious events (open/access/metadata) and genuine content changes (create/remove/modify-data/rename), including the Kubernetes `..data` symlink swap case.
- Keep or refine the existing event-kind filter so it is consistent with the content-verification approach.

## Acceptance Criteria

- [ ] The watcher does not trigger rotation when a watched file is merely read/opened or its metadata (e.g. atime) changes.
- [ ] The watcher triggers rotation exactly once when a watched file's content actually changes.
- [ ] A Kubernetes secret `..data` symlink swap (content change) triggers rotation.
- [ ] No rotation spam: running the app with a stable secret produces zero `rotation_started` / `file_change_detected` logs over a sustained interval.
- [ ] All existing and new `file_watcher` unit tests pass (`cargo test --lib utils::file_watcher`).

## Dependencies

_None_