Migrate KASRewrapClient from /kas/v2/* REST to /kas.AccessService/* ConnectRPC

## Context

The opentdf-platform Go server only exposes KAS over ConnectRPC at:

- `POST /kas.AccessService/PublicKey`
- `POST /kas.AccessService/Rewrap`

It has **no** `/kas/v2/*` REST routes — those were a gRPC-gateway compatibility layer that the platform no longer ships. A request to `/kas/v2/kas_public_key` against a current platform returns 404.

The official Go SDK talks exclusively to the ConnectRPC paths. Any iOS client targeting a deployment where the upstream KAS is opentdf-platform — including the Arkavo edge where arks reverse-proxies to a platform process — will fail to rewrap.

## Goal

Switch `KASRewrapClient` (and the rest of the Swift call sites) to ConnectRPC so they talk to the platform's canonical surface.

## Scope

- `OpenTDFKit/KASRewrapClient.swift` — the primary client. Replace the REST POST in `rewrapNanoTDF(...)` with a ConnectRPC unary call.
- `OpenTDFKitCLI/Commands.swift` — any CLI subcommands hitting the REST path.
- `OpenTDFKitTests/IntegrationTests.swift` — mock and assertions need to speak Connect.

## Open design questions (for the implementer)

- **Connect client choice.** Use `connectrpc/connect-swift` (official, generated from proto) or hand-roll URLSession POSTs against the well-known Connect URL shape (`POST //` with `content-type: application/json`). Hand-rolling is small and matches the existing `URLSession` patterns in this codebase; connect-swift brings type safety + retry/streaming primitives we don't currently need.
- **Request envelope.** Today the request body is JSON containing `signedRequestToken` (JWT wrapping an `UnsignedRewrapRequest`). That envelope is unchanged — only the URL and content-type semantics change (Connect uses `content-type: application/json` for unary, same as today, but the URL path becomes `/kas.AccessService/Rewrap`).
- **Backward compat.** Keep a `transport: .restV2 | .connect` enum on the client for a transition period? Existing iOS app builds against older KAS servers would break otherwise.
- **Error decoding.** Connect returns `{ code: \"...\", message: \"...\" }` on non-2xx; map to existing throwing patterns.

## Acceptance criteria

- `KASRewrapClient.rewrapNanoTDF` hits `/kas.AccessService/Rewrap`.
- Public-key fetch (wherever it lives) hits `/kas.AccessService/PublicKey`.
- `OpenTDFKitCLI` and `OpenTDFKitTests/IntegrationTests` build and pass against a Connect-speaking mock.
- Round-trip test against a real opentdf-platform instance succeeds.
- README/usage docs updated.

## Related

- Arkavo edge deployment using arks → platform reverse proxy: arkavo-org/arkavo-rs#54
- opentdf-platform SDK reference: `sdk/kas_client.go` `getPublicKey` and `Rewrap`

Start with OpenTDFKit/KASRewrapClient.swift and the REST calls in OpenTDFKitCLI/Commands.swift; compare them with sdk/kas_client.go’s getPublicKey and Rewrap paths. Update the listed client, CLI, and integration test files after choosing the transport and error handling approach. Done means the mock and real-platform round trips use /kas.AccessService/PublicKey and /kas.AccessService/Rewrap, and the README or usage docs are updated.

Written by the indexing model from the issue text.