Add piv admin keys with a one-shot default-key check

[mmlado]

• New piv admin keys: the admin security domain's key table (versions, key IDs, types, lengths), read without authenticating. Same read as piv admin status; the table rendering is shared.
• --check-default: exactly one authentication to key version 1 with the publicly known GlobalPlatform test key, with a warning first.
  • Success is a completed authentication: nothing is counted against the card, and the verdict says anyone can administer the PIV applet.
  • A wrong key is reported as one counted failed authentication, which the next successful piv admin authenticate clears.
  • A refused INITIALIZE UPDATE (new InitializeUpdateRejected, raised from PivAdmin.open) is reported as undetermined.
  • The check is skipped, table still shown, under --dry-run or when the key table has no key version 1. It never tries a second key.
• ssd.py gains CUSTOMER_KEY_VERSION = 1 and CRYPTNOX_KEY_VERSION = 2 for the rotation commands to come.
• JSON: the admin status payload plus default_key_check (null, or performed, key_version, answers_to_default, failed_authentication_counted, detail).

Both outcomes verified on a D600 development card: the default-key success path, and a wrong-key failure through the same open() call cleared by the following default-key authentication. Ruff, 512 pytest, Sphinx -W all green.

🤖 Generated with Claude Code