Feat v0.6.7 native mtls (#42)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.6.7 — Native mTLS
+
+End-to-end mutual TLS without a reverse proxy. Targets systemd+podman
+deployments where the Go binary terminates TLS itself.
+
+### Added
+
+- **`TLS_MODE` config**: Three values — `none` (default, plain HTTP), `server`
+  (TLS, no client cert), `mtls` (mutual TLS, client cert required). Independent
+  of `AUTH_MODE`. Combinations: `server`+`builtin` for HTTPS with password auth,
+  `mtls`+`mtls` for full mTLS identity, `none`+`mtls` for proxy-terminated
+  (existing behavior).
+- **TLS server mode**: Binary calls `ListenAndServeTLS` directly when
+  `TLS_MODE` is `server` or `mtls`. TLS 1.3 minimum, no cipher suite
+  configuration. Config: `TLS_CERT`, `TLS_KEY`, `TLS_CA` path env vars.
+- **`MTLSNativeProvider`**: New auth provider that reads
+  `r.TLS.PeerCertificates[0]` directly — no header trust. `Subject.CommonName`
+  becomes username, `sha256(cert.Raw)` becomes `external_id`. Auto-provisions
+  users identically to the proxy provider. Selected when `AUTH_MODE=mtls` and
+  `TLS_MODE=mtls`.
+- **Shared mTLS helpers**: `ParseDN()`, `FingerprintCert()`, and
+  `resolveOrProvision()` extracted to `mtls_helpers.go`. Both proxy and native
+  providers consume the same user resolution logic.
+- **Peer TLS config**: `BuildPeerTLSConfig()` constructs a `*tls.Config` for
+  outbound node-to-node connections (forward-looking — cluster registry is
+  currently DB-backed with no HTTP peer calls).
+- **`switchboard-ca.sh`**: Shell wrapper around openssl for cert provisioning.
+  Three commands: `init` (CA keypair), `issue-node` (365d, ServerAuth +
+  ClientAuth EKU), `issue-user` (90d, ClientAuth only). All ECDSA P-256, PEM
+  output.
+- **12 new tests**: `FingerprintCert` determinism, native provider unit tests
+  (nil TLS, empty certs, no CN, email extraction), TLS integration tests (no
+  cert rejected, wrong CA rejected, expired cert rejected, valid cert accepted,
+  peer certificate visibility).
+
+### Changed
+
+- **`MTLSProvider` → `MTLSProxyProvider`**: Renamed for clarity. Config type
+  `MTLSConfig` → `MTLSProxyConfig`. Constructor `NewMTLSProvider` →
+  `NewMTLSProxyProvider`. File `mtls.go` → `mtls_proxy.go`.
+
 ## v0.6.6 — Final Hardening
 
 Final pass before public release. Security, correctness, and developer