Returns aggregate counts derived from cryptographic_exchange rows
scoped to (tenantId, applicationId) with status = ACTIVE and
deletedAt IS NULL:

• activeExchangesCount — COUNT(*) of Cryptographic Exchanges in
  ACTIVE state for the application.
• distinctActiveKeysCount — COUNT(DISTINCT asset_kid) over those
  same ACTIVE Exchanges. May be smaller than activeExchangesCount
  when multiple Exchanges target the same key.

Empty-result contract: a tenant with no ACTIVE Exchanges for the
application returns HTTP 200 with {0, 0} — NEVER 404 (the 404 case
is reserved for unknown applicationId within the tenant).

Tenant boundary: enforced FIRST via validateTenantAccess. A
user from Tenant A querying Tenant B's application receives 403
BEFORE any application-existence lookup or scope decision (per the
workspace's tenant-boundary-first invariant).

Authorization: requires scope admin.tenant.exchange.read.