MicroCeph remote replication quality improvements

## Background

The remote replication framework in MicroCeph (RBD + CephFS) is built around a per-request finite state machine (`ceph/replication.go`) with workload-specific handlers. A review of the framework surfaced several quality issues that fall into three coherent buckets: FSM model cleanup, REST surface redesign, and concurrency safety. Each bucket is tracked as a child issue below.

## Goals

- Make the FSM model honest about what is per-resource lifecycle and what is a site-wide action.
- Make the REST surface identify operations by `(method, path)` alone, with no body-encoded discriminator and no overloaded URLs.
- Make concurrent mutating requests on the same resource safe across the cluster.

## Children

- [ ] #727 — Refactor replication FSM: per-workload tables, idempotent transitions, integrated invalid state. Foundation; lands first.
- [ ] #728 — Redesign replication REST API: resource-scoped paths, `/actions/` namespace for site-wide ops, drop body-encoded request type. Depends on #727.
- [ ] #729 — Serialize concurrent mutating replication requests on the same resource. Depends on #727.

## Landing order

1. #727 (FSM cleanup).
2. #728 and #729 in parallel.

## Out of scope

- Cross-process coordination with admin-run raw `rbd` / `ceph` CLI commands.
- RGW replication (handler not yet implemented).