Inspects a PKCS#12 or JKS keystore and reports, per alias, the detected algorithm, the
projected Stable KID, and the cryptographic purpose derived from the certificate's X.509
KeyUsage (ENCRYPT_DECRYPT, SIGN_VERIFY, or AMBIGUOUS), by S2S-proxying to Core API. Sent
as multipart/form-data with the same three parts as the import endpoint: metadata
(JSON), keystore (binary file), and an optional password (binary).

This is a pure preview: NOTHING is imported, wrapped, audited, or persisted, and an
ambiguous alias is reported (200) rather than rejected. The password is forwarded to Core
API as raw bytes — never logged, stringified, or echoed.

Authorization: requires scope migration.importKeystore (shared with the import
endpoint; analysis is gated on the same scope).