Feat v0.6.7 native mTLS (#42)

End-to-end mutual TLS without a reverse proxy. Go binary terminates
TLS itself via ListenAndServeTLS. TLS_MODE config (none/server/mtls)
is independent of AUTH_MODE.

- MTLSNativeProvider reads PeerCertificates directly (no header trust)
- Shared helpers extracted to mtls_helpers.go (ParseDN, FingerprintCert)
- MTLSProvider renamed to MTLSProxyProvider for clarity
- BuildPeerTLSConfig for future node-to-node mTLS
- switchboard-ca.sh: CA init, issue-node, issue-user (ECDSA P-256)
- 12 new tests (unit + TLS integration)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/config/config.go

@@ -53,10 +53,19 @@ type Config struct {
 	LogFormat string
 	LogLevel  string
 
+	// TLS termination
+	// TLS_MODE: "none" (default) | "server" (TLS, no client cert) | "mtls" (mutual TLS)
+	// When server or mtls: binary calls ListenAndServeTLS directly.
+	// TLS_MODE and AUTH_MODE are independent knobs.
+	TLSMode string
+	TLSCert string // path to server certificate PEM
+	TLSKey  string // path to server private key PEM
+	TLSCA   string // path to CA certificate PEM (required for mtls)
+
 	// Auth mode: "builtin" (default) | "mtls" | "oidc"
 	AuthMode string
 
-	// mTLS
+	// mTLS (proxy mode)
 	// Headers injected by TLS-terminating reverse proxy.
 	MTLSHeaderDN          string // default "X-SSL-Client-DN"
 	MTLSHeaderVerify      string // default "X-SSL-Client-Verify"
@@ -141,6 +150,12 @@ func Load() *Config {
 		LogFormat: getEnv("LOG_FORMAT", "text"),
 		LogLevel:  getEnv("LOG_LEVEL", "info"),
 
+		// TLS
+		TLSMode: getEnv("TLS_MODE", "none"),
+		TLSCert: getEnv("TLS_CERT", ""),
+		TLSKey:  getEnv("TLS_KEY", ""),
+		TLSCA:   getEnv("TLS_CA", ""),
+
 		AuthMode: getEnv("AUTH_MODE", "builtin"),
 
 		// mTLS