feat(remote): verify server-CDM vault keys on the client and report bad pairs

The licence response lists KIDs a server vault supplied, the client proves them with the decode check, and a bad pair goes to the new session keys/bad route so the server flags its own row. Client vault keys go first over --remote, and the dashboard health warns when no SQLite vault can store flags.

tests/remote/unit/test_extract_pssh_strict.py

@@ -46,13 +46,14 @@ async def _run_batch(monkeypatch, tracks, cdm_type, calls):
     session = SimpleNamespace(
         service_tag="EXAMPLE",
         service_instance=SimpleNamespace(),
+        served_keys={},
         tracks=SimpleNamespace(get=tracks.get),
     )
 
     async def fake_get_session(session_id, request):
         return session
 
-    def fake_single(service, title, track, pssh_str, drm_type, request):
+    def fake_single(service, title, track, pssh_str, drm_type, request, sources=None):
         calls.append((pssh_str, drm_type))
         return {"00" * 16: "key"}