Add PKCS#11 startup self-test health reporting

EnvelopeGenerator.Application/Common/Configurations/Pkcs11Options.cs

@@ -15,11 +15,10 @@ public sealed class Pkcs11Options
     public const string SectionName = "Crypt:Pkcs11";
 
     /// <summary>
-    /// Absolute or resolvable file path of the PKCS#11 provider library.
+    /// Optional base directory that contains the <c>pkcs11</c> folder.
+    /// If null/empty, runtime uses the application base directory.
     /// </summary>
-    [Required]
-    [MinLength(1)]
-    public required string LibraryPath { get; set; }
+    public string? AssetsRootPath { get; set; }
 
     /// <summary>
     /// Optional numeric slot identifier used to directly select the target token slot.
@@ -37,9 +36,23 @@ public sealed class Pkcs11Options
     public string? ProxySocket { get; set; }
 
     /// <summary>
-    /// Optional full path to <c>pkcs11-tool</c>, used by diagnostics and fallback paths.
+    /// Resolved absolute PKCS#11 proxy module path used at runtime.
+    /// Computed from <see cref="AssetsRootPath"/> and runtime defaults.
     /// </summary>
-    public string? ToolPath { get; set; }
+    public string ResolvedLibraryPath { get; private set; } = string.Empty;
+
+    /// <summary>
+    /// Resolved absolute pkcs11-tool path used at runtime.
+    /// Computed from <see cref="AssetsRootPath"/> and runtime defaults.
+    /// Can be null when tool fallback is not available.
+    /// </summary>
+    public string? ResolvedToolPath { get; private set; }
+
+    public void SetResolvedPaths(string resolvedLibraryPath, string? resolvedToolPath)
+    {
+        ResolvedLibraryPath = resolvedLibraryPath;
+        ResolvedToolPath = resolvedToolPath;
+    }
 
     /// <summary>
     /// User PIN used to authenticate to the PKCS#11 token session.