feat(security): trusted-services surface + auth mgmt client (M2 §3)

Maestro is the UI/CA, not the enforcement: the auth service owns its
authorized-keys trust store. This is Maestro's side of the flow.

- lib/authmgmt: mTLS management client (Maestro's own identity cert from
  the instance CA) for /internal/{attestation,authorizations,revoke,
  pending}; RevokeServiceBestEffort for uninstall.
- handlers/peers: GET /api/peers, /api/peers/attestation, POST
  approve/revoke.
- uninstall: revoke the service's authorization in the auth trust store
  alongside the CRL identity revocation.
- frontend: TrustedServices panel (pending first-contact authorizations +
  approved keys with authorize/ignore/revoke actions).
- spec.yaml: document the new endpoints and schemas.
- housekeeping: untrack pki test log artifacts, gofmt fixes in pki.

src/main.go

@@ -25,8 +25,9 @@ import (
 
 	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/actions"
 	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/containers"
+	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/peers"
 	handlers "git.dcntrlized.org/Dcntrlized/Maestro/handlers/registry"
-		libcontainers "git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
+	libcontainers "git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
 )
@@ -92,6 +93,15 @@ func main() {
 	mux.HandleFunc("/api/actions/{containerId}/{actionName}", actions.RunAction)
 	mux.HandleFunc("/api/registry", handlers.GetRegistry)
 
+	// Trusted-services surface (security theme M2 §3): pending first-contact
+	// authorizations and the owner's approve/revoke actions, forwarded to the
+	// auth service's own trust store.
+	peersHandler := peers.NewHandler()
+	mux.HandleFunc("/api/peers", peersHandler.List)
+	mux.HandleFunc("/api/peers/attestation", peersHandler.Attestation)
+	mux.HandleFunc("/api/peers/approve", peersHandler.Approve)
+	mux.HandleFunc("/api/peers/revoke", peersHandler.Revoke)
+
 	if os.Getenv("DEV_MODE") != "true" {
 		frontendDir, err := fs.Sub(embeddedFrontend, "frontend/dist")
 		if err != nil {