vault-k8s stays sealed after controller restart (missing unseal_vault hook)

## Bug

`GenericUnsealVaultJujuExtension` re-unseals vault-k8s after scale, pod-delete, statefulset-restart, and model-migration, but had no hook for a Juju **controller** restart. `reboot_model_controller()` (used by `test_controller_restart` and as a CAAS-worker workaround inside `test_model_controller_migration`) never called any extension hook, so vault-k8s is left `blocked: Please unseal Vault` and the subsequent idle-wait times out.

Reproduced locally against the exact Test Observer bundle (vault-k8s 2.0/stable rev565 + self-signed-certificates, CMR to parca-k8s): confirmed in the production log for test execution 668699 that vault goes `blocked: Please unseal Vault` right after the controller StatefulSet rollout restart in `test_model_controller_migration`.

Affects ~26+ untriaged `test_deploy`/`test_model_controller_migration` failures for vault-k8s in Test Observer.

Fixed by adding a `post_reboot_controller` hook to `JujuExtension`/`JujuClient.reboot_model_controller`, implemented in `unseal_vault` to re-unseal without re-authorizing.

Start with JujuExtension and JujuClient.reboot_model_controller, then inspect reboot_model_controller(), reboot_model_controller migration coverage, and GenericUnsealVaultJujuExtension.unseal_vault. Add the post_reboot_controller hook so controller restarts re-unseal vault-k8s without re-authorizing, and run test_controller_restart and test_model_controller_migration to confirm the deployment reaches idle.

Written by the indexing model from the issue text.