[refactor](maestro): retire the PKI and federation identity layer

Contract rev 9 removes the instance CA, client certificates, the peer listener and the trust store fleet-wide. Internal traffic is plaintext HTTP on each service single :8080 listener, so there is no peer identity left to authorize: delete lib/pki, lib/federation, devboot, the per-service database role model and the /api/peers* and /api/instances surfaces, and drop the console Trusted services UI. Config delivery now rides a dedicated ES256 token from lib/configsign rather than mTLS, and the instance fingerprint is derived from a persisted random key and is informational only. main.go also wires the surfaces introduced by the later commits, which this change is what makes possible.

src/lib/containers/infra.go

@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"strings"
 
-	"git.dcntrlized.org/Dcntrlized/Maestro/lib/db"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
 	libregistry "git.dcntrlized.org/Dcntrlized/Maestro/lib/registry"
@@ -105,16 +104,6 @@ func ensureInfraRunning(ctx context.Context, serviceName, label string) error {
 	if err := StartContainer(ctx, types.RegistryContainer{Name: serviceName}); err != nil {
 		return fmt.Errorf("failed to start %s %s: %w", label, serviceName, err)
 	}
-
-	// For the shared database, reconcile the CONNECT authorization against the
-	// peers Maestro manages (M2 §4): per-role CONNECT grants and, in mTLS mode,
-	// PUBLIC revoked. Best-effort — the database advertises infra-relevant
-	// problems as warnings, never as boot failures.
-	if serviceName == DatabaseServiceName {
-		if err := dbctl.New(dc).SyncAuthorization(ctx); err != nil {
-			logger.Warn("Shared database authorization sync failed: %v", err)
-		}
-	}
 	return nil
 }