Feat v0.6.7 native mtls (#42)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/config/config.go

@@ -53,10 +53,19 @@ type Config struct {
 	LogFormat string
 	LogLevel  string
 
+	// TLS termination
+	// TLS_MODE: "none" (default) | "server" (TLS, no client cert) | "mtls" (mutual TLS)
+	// When server or mtls: binary calls ListenAndServeTLS directly.
+	// TLS_MODE and AUTH_MODE are independent knobs.
+	TLSMode string
+	TLSCert string // path to server certificate PEM
+	TLSKey  string // path to server private key PEM
+	TLSCA   string // path to CA certificate PEM (required for mtls)
+
 	// Auth mode: "builtin" (default) | "mtls" | "oidc"
 	AuthMode string
 
-	// mTLS
+	// mTLS (proxy mode)
 	// Headers injected by TLS-terminating reverse proxy.
 	MTLSHeaderDN          string // default "X-SSL-Client-DN"
 	MTLSHeaderVerify      string // default "X-SSL-Client-Verify"
@@ -141,6 +150,12 @@ func Load() *Config {
 		LogFormat: getEnv("LOG_FORMAT", "text"),
 		LogLevel:  getEnv("LOG_LEVEL", "info"),
 
+		// TLS
+		TLSMode: getEnv("TLS_MODE", "none"),
+		TLSCert: getEnv("TLS_CERT", ""),
+		TLSKey:  getEnv("TLS_KEY", ""),
+		TLSCA:   getEnv("TLS_CA", ""),
+
 		AuthMode: getEnv("AUTH_MODE", "builtin"),
 
 		// mTLS