A practical pattern for Azure Key Vault ownership, RBAC, Private Endpoint DNS, rotation, and recovery.