feat(dev): DCNTRLIZED_DEV drives dev mode; dev fleet runs real mTLS

The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every
docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors
without downgrading control-plane security:

- lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and
  DCNTRLIZED_GITEA_URL (renamed from GITEA_URL).
- authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV
  — dev satellites keep a plaintext RN-facing listener, production mTLS. The
  auth-management edge (New()) stays mTLS in both, preferring
  DCNTRLIZED_AUTH_URL in dev.
- Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the
  orchestrator no longer runs plaintext, and no longer injects the escape
  hatch into services it starts.
- lib/devboot: at boot (dev only) Maestro provisions the identities its
  compose-managed peers bind-mount at /dcntrlized/pki (before infra boots)
  and approves the known fleet in the auth trust store. Unknown peers still
  record a pending authorization and are refused (mechanisms active).
- Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL);
  the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.

docker-compose.debug.yaml

@@ -14,11 +14,9 @@ services:
       context: .
       dockerfile: Dockerfile.debug
     environment:
-      - DEV_MODE=true
       - DCNTRLIZED_DEV=true
-      - INSECURE_INTERNAL=1
       - XDG_DATA_HOME=/data
-      - GITEA_URL=${GITEA_URL:-http://192.168.122.183:3000}
+      - DCNTRLIZED_GITEA_URL=${DCNTRLIZED_GITEA_URL:-http://192.168.122.183:3000}
       - GITEA_REGISTRY_RO_TOKEN=${GITEA_REGISTRY_RO_TOKEN}
       - GITEA_RW_PACKAGE_TOKEN=${GITEA_RW_PACKAGE_TOKEN}
       - GITEA_ORG=${GITEA_ORG:-Dcntrlized}