feat(auth): mTLS client-certificate authentication for the management plane

[Bugs5382]

What and why

Slice A of productionize. Replaces the dev auth stub with real mTLS client-cert auth: when authBypass is false the manager serves HTTPS with RequireAndVerifyClientCert against the operator CA, derives the operator identity + access level from the presented certificate, and exposes it via WhoAmI. The authBypass dev path (h2c) is preserved.

• config: tlsCert / tlsKey / operatorCAPath, required when authBypass is false.
• authz: Identity{CN,Serial,Level} on the request context; ClientCertMiddleware (401 no peer cert, 403 cert without the access-level extension) and BypassMiddleware (dev identity). Auth is HTTP middleware, not a Connect interceptor, because only the HTTP layer sees the TLS peer certificate.
• cmd/manager: TLS listener (RequireAndVerifyClientCert + operator-CA pool + server cert); h2c kept for authBypass. The old Bypass() interceptor is retired.
• fleet.WhoAmI: echoes the verified identity (Unauthenticated if absent).
• Bumps the api dependency to the merged WhoAmI revision.

Builds on the A0 access-level codec (#16) and api WhoAmI (CryptOS-PKI/api#44), both merged.

Closes #17

Verification

• Lint clean (gofmt / go vet / golangci-lint 0)
• Tests pass (config validation; authz identity + middleware incl. 401/403 paths; buildTLSConfig incl. bad-CA; WhoAmI echo + Unauthenticated)
• Build succeeds (every commit; api bump + handler land together)
• License headers (task license 0 changed)

How this was verified

Whole-branch review confirmed no anonymous path (single mux behind ClientCertMiddleware, RequireAndVerifyClientCert, bypass reachable only when authBypass true and validation forces trust material otherwise), identity derived solely from the verified peer cert, and no broken intermediate commit. Live cert-in-browser verification is the runbook step at deploy (docs/operator-pki.md).