fix: identity mounts must use the pki/services/<name> layout

docker-compose.debug.yaml

@@ -38,8 +38,8 @@ services:
       # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
       # so the authproxy client authenticates to the mTLS auth hub.
       - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
-      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
-      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
 
     working_dir: /app/