feat(fleet): read-only Fleet Manager backend

[Bugs5382]

Summary

First Go code for the manager control plane: a Connect server that serves cryptos.fleet.v1.FleetService to the web UI and dials CryptOS nodes over gRPC/mTLS. In-memory Store adapter (Postgres-ready), config-driven node inventory, per-node degradation, seeded catalog. Read-only this phase.

Acceptance criteria

• Connect server (auth-bypass interceptor, CORS, h2c) serving ListNodes/GetNode/ListCertificates + catalog reads.
• mTLS node client (presents admin client cert; server verify relaxed for the ephemeral node cert).
• Store interface with in-memory impl; unit tests green.
• Live: serves both local nodes' status/identity/certs.

Notes

Depends on the api FleetService PR (consumed via a local replace until api is published).