Add replicated block volumes across providers

[flo2517]

Provide distributed block volumes replicated across independent providers, so a workload's persistent disk survives the loss of the provider hosting it. This is the mutable counterpart to #58: object storage can be content-addressed and immutable, block storage cannot, so it needs replication, consistency, and failure semantics of its own.

Blocked by: ADR-018 (see ADR-012 §6) — no implementation before acceptance.

Acceptance criteria:

• ADR-018 states the replication model, the consistency guarantee offered to the workload, and the durability target, in those terms and not as an aspiration;
• volume data is encrypted with tenant-held keys before leaving the tenant boundary; a replica holder learns only ciphertext;
• replica placement is spread across independent providers, and independence is defined and enforced rather than assumed from distinct account identifiers;
• a lost or corrupt replica is detected, reported, and re-replicated within a stated bound; silent corruption is treated as a first-class failure mode;
• split-brain and concurrent-writer scenarios have a defined resolution that follows ADR-012 §4 — the chain is the tiebreaker, never wall-clock time;
• a volume that cannot meet its replication guarantee refuses writes explicitly rather than accepting them at reduced durability without telling anyone;
• interaction with Add auto-healing and automatic workload migration #62 is explicit: a migrating workload reattaches its volume, and the ordering constraints for that are stated;
• tests cover normal read/write, single and multiple replica loss, silent corruption, network partition with concurrent writers, re-replication under churn, and reattachment after migration.

---

Original request (FR, preserved verbatim):

Implémenter un système de stockage bloc distribué avec réplication pour la tolérance aux pannes.