Serve the listener over TLS with ClientAuth=RequireAndVerifyClientCert
trusting the instance CA (shared tlsutil.ServerConfig): only Maestro can
drive actions (T4), and the peer edge is encrypted. INSECURE_INTERNAL=1
(dev debug compose) keeps the listener plaintext for the RN client's
direct mode and hot reload.
- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
(POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.
Admin