Feat v0.6.7 native mtls (#42)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

docs/DESIGN-native-mtls.md

@@ -1,7 +1,7 @@
 # DESIGN — Native mTLS
 
 **Version:** v0.6.7
-**Status:** Proposed
+**Status:** Implemented
 **Author:** Jeff / Claude session 2026-03-31
 
 ---
@@ -172,17 +172,17 @@ their own `node-N.key`.
 
 ### Cert Provisioning Tooling
 
-A shell script (`scripts/armature-ca.sh`) wrapping `openssl` is the
+A shell script (`scripts/switchboard-ca.sh`) wrapping `openssl` is the
 KISS path. No new binary, no new dependency. Three commands:
 
 ```
-armature-ca init
+switchboard-ca init
     → generates cluster-ca.crt + cluster-ca.key in ./ca/
 
-armature-ca issue-node --name node-1 --san "node-1.internal,10.0.0.1"
+switchboard-ca issue-node --name node-1 --san "node-1.internal,10.0.0.1"
     → generates node-1.crt + node-1.key in ./nodes/
 
-armature-ca issue-user --cn jeff [--email jeff@example.com]
+switchboard-ca issue-user --cn jeff [--email jeff@example.com]
     → generates jeff.crt + jeff.key in ./users/
 ```
 
@@ -280,7 +280,7 @@ The new code is:
 | `server/auth/mtls_helpers.go` | Shared: `ParseDN`, `FingerprintCert`, `resolveOrProvision` |
 | `server/auth/mtls_native_test.go` | Unit + integration tests |
 | `server/config/tls.go` | `TLSConfig` struct, loader, validation |
-| `scripts/armature-ca.sh` | Cert provisioning wrapper |
+| `scripts/switchboard-ca.sh` | Cert provisioning wrapper |
 
 `server/auth/mtls.go` (existing) is renamed to `mtls_proxy.go` for
 clarity. No behavioral changes to the proxy provider.