Runs a full wrap/unwrap round trip against the deployment's bound key-protection
backend and returns the verdict, so a misconfigured or unreachable backend can be
diagnosed BEFORE a key operation fails. Required scope:
admin.platform.key-backend.test, plus the ROOT platform tenant.

A failed test is an HTTP 200. The question this operation asks is whether

the backend works; "it does not" is an answer to that question, so it arrives as a
200 carrying a FAILED verdict. A client that renders that as an error loses the
distinction that makes the operation useful.

There is no 502 in this operation's status list, and that is deliberate.

The round trip runs IN admin-api's own process, against the backend this
deployment is bound to — nothing is delegated, so no delegation can fail. The one
refusal it can answer is 503, when too many connection tests are
already in flight on this instance.

The verdict's reason comes from a closed vocabulary
(SelfTestReason) that can carry no credential, ARN, resource path,
Azure account URL, region or account id, and no vendor exception text. A client MUST
tolerate a reason it does not recognise and render it as an unknown verdict —
never as a pass.

It advances no state, writes no row and provisions no KEK. Its one lasting effect
is the recorded verdict itself, which is the point:
GET /api/v3/admin/platform/setup/status reports the fresh
selfTestVerdict and selfTestReason immediately

afterwards, with no restart.