dev: bump dcntrlized-auth v0.1.2; DCNTRLIZED_DEV selector + mTLS identity mount

- go.mod: dcntrlized-auth v0.1.1 -> v0.1.2 (tlsutil.IsDev/AuthBaseURL and the
  identity-mount client fallback).
- docker-compose.debug.yaml: DEV_MODE replaced by DCNTRLIZED_DEV=true (the
  single dev selector); mount the devboot-issued identity at the shared-module
  default /dcntrlized/pki so the authproxy edge is mTLS. INSECURE_INTERNAL=1
  stays: the RN-facing listener must stay plaintext.

docker-compose.debug.yaml

@@ -34,14 +34,22 @@ services:
       - go-mod-cache:/go/pkg/mod
       - go-build-cache:/root/.cache/go-build
       - /app/src/tmp # Exclude Air's tmp dir from syncing
+      # mTLS identity for the auth edge: the certs Maestro issued for the dev
+      # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
+      # so the authproxy client authenticates to the mTLS auth hub.
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
 
     working_dir: /app/
 
     # Environment variables for the application
     environment:
-      - DEV_MODE=true
-      # Security theme M2 §2: dev escape hatch — keep the listener plaintext
-      # so the RN client (direct mode) and hot reload work without certs.
+      # DCNTRLIZED_DEV is the single dev selector (registry/auth URLs).
+      - DCNTRLIZED_DEV=true
+      # Security theme M2 §2: keep THIS listener plaintext so the RN client
+      # (direct mode) and hot reload work without certs. The auth proxy edge
+      # is still mTLS (mounted identity above).
       - INSECURE_INTERNAL=1
       # Application configuration
       # - PORT=8080