feat(dev): DCNTRLIZED_DEV drives dev mode; dev fleet runs real mTLS

The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every
docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors
without downgrading control-plane security:

- lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and
  DCNTRLIZED_GITEA_URL (renamed from GITEA_URL).
- authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV
  — dev satellites keep a plaintext RN-facing listener, production mTLS. The
  auth-management edge (New()) stays mTLS in both, preferring
  DCNTRLIZED_AUTH_URL in dev.
- Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the
  orchestrator no longer runs plaintext, and no longer injects the escape
  hatch into services it starts.
- lib/devboot: at boot (dev only) Maestro provisions the identities its
  compose-managed peers bind-mount at /dcntrlized/pki (before infra boots)
  and approves the known fleet in the auth trust store. Unknown peers still
  record a pending authorization and are refused (mechanisms active).
- Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL);
  the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.

docker-compose.yaml

@@ -19,8 +19,6 @@ services:
       - GITEA_RW_PACKAGE_TOKEN=${GITEA_RW_PACKAGE_TOKEN}
       - GITEA_ORG=${GITEA_ORG:-Dcntrlized}
       - GITEA_USER=${GITEA_USER:-admin}
-      - GITEA_URL=${GITEA_URL:-http://192.168.122.183:3000}
-      - DCNTRLIZED_DEV=${DCNTRLIZED_DEV:-true}
       - GIT_TOKEN=${GIT_TOKEN}
       - REGISTRY_USER=${REGISTRY_USER:-admin}