[refactor](maestro): retire the PKI and federation identity layer

Contract rev 9 removes the instance CA, client certificates, the peer listener and the trust store fleet-wide. Internal traffic is plaintext HTTP on each service single :8080 listener, so there is no peer identity left to authorize: delete lib/pki, lib/federation, devboot, the per-service database role model and the /api/peers* and /api/instances surfaces, and drop the console Trusted services UI. Config delivery now rides a dedicated ES256 token from lib/configsign rather than mTLS, and the instance fingerprint is derived from a persisted random key and is informational only. main.go also wires the surfaces introduced by the later commits, which this change is what makes possible.

src/lib/env/env.go

@@ -16,8 +16,9 @@
 // Package env centralizes environment-derived configuration. DCNTRLIZED_DEV is
 // the single canonical dev-mode flag, injected by every docker-compose.dev.yaml
 // and docker-compose.debug.yaml. It selects dev-only endpoints and behaviors
-// (registry URL, plaintext satellite peer edges) — it never downgrades the
-// transport security of the control-plane edges, which run mTLS in dev too.
+// (registry URL, debug selectors). After rev 9 the fleet-wide internal
+// transport is plaintext HTTP on a single :8080 listener in every mode, so dev
+// mode no longer downgrades anything.
 package env
 
 import "os"