dev: bump dcntrlized-auth v0.1.2; DCNTRLIZED_DEV selector + mTLS identity mount

- go.mod: dcntrlized-auth v0.1.1 -> v0.1.2 (tlsutil.IsDev/AuthBaseURL and the
  identity-mount client fallback).
- docker-compose.debug.yaml: DEV_MODE replaced by DCNTRLIZED_DEV=true (the
  single dev selector); mount the devboot-issued identity at the shared-module
  default /dcntrlized/pki so the authproxy edge is mTLS. INSECURE_INTERNAL=1
  stays: the RN-facing listener must stay plaintext.

docker-compose.debug.yaml

@@ -34,14 +34,22 @@ services:
       - go-mod-cache:/go/pkg/mod
       - go-build-cache:/root/.cache/go-build
       - /app/src/tmp # Exclude Air's tmp dir from syncing
+      # mTLS identity for the auth edge: the certs Maestro issued for the dev
+      # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
+      # so the authproxy client authenticates to the mTLS auth hub.
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
 
     working_dir: /app/
 
     # Environment variables for the application
     environment:
-      - DEV_MODE=true
+      # DCNTRLIZED_DEV is the single dev selector (registry/auth URLs).
-      # Security theme M2 §2: dev escape hatch — keep the listener plaintext
+      - DCNTRLIZED_DEV=true
-      # so the RN client (direct mode) and hot reload work without certs.
+      # Security theme M2 §2: keep THIS listener plaintext so the RN client
+      # (direct mode) and hot reload work without certs. The auth proxy edge
+      # is still mTLS (mounted identity above).
       - INSECURE_INTERNAL=1
       # Application configuration
       # - PORT=8080

src/go.mod

@@ -3,7 +3,7 @@ module git.dcntrlized.org/Dcntrlized/KeepNote
 go 1.26.5
 
 require (
-	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1
+	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 )

src/go.sum

@@ -1,5 +1,5 @@
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1 h1:+uftpnwZL08rgGT6aS55EVM4BgEt4rVnPq4CwnhGQhI=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2 h1:1rU/15q81FL9D+VavBtEqPpnIleam37EvA+VoI/SNOs=
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1/go.mod h1:1ECTUA+Voaxhajld2XBZL2bHd+GYabFMEcx62CQ52M4=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2/go.mod h1:1ECTUA+Voaxhajld2XBZL2bHd+GYabFMEcx62CQ52M4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=