feat(dev): DCNTRLIZED_DEV drives dev mode; dev fleet runs real mTLS

The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every
docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors
without downgrading control-plane security:

- lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and
  DCNTRLIZED_GITEA_URL (renamed from GITEA_URL).
- authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV
  — dev satellites keep a plaintext RN-facing listener, production mTLS. The
  auth-management edge (New()) stays mTLS in both, preferring
  DCNTRLIZED_AUTH_URL in dev.
- Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the
  orchestrator no longer runs plaintext, and no longer injects the escape
  hatch into services it starts.
- lib/devboot: at boot (dev only) Maestro provisions the identities its
  compose-managed peers bind-mount at /dcntrlized/pki (before infra boots)
  and approves the known fleet in the auth trust store. Unknown peers still
  record a pending authorization and are refused (mechanisms active).
- Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL);
  the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.

src/main.go

@@ -28,7 +28,9 @@ import (
 	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/peers"
 	handlers "git.dcntrlized.org/Dcntrlized/Maestro/handlers/registry"
 	libcontainers "git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
+	"git.dcntrlized.org/Dcntrlized/Maestro/lib/devboot"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
+	"git.dcntrlized.org/Dcntrlized/Maestro/lib/env"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
 )
 
@@ -64,6 +66,13 @@ func main() {
 		if _, err := pki.EnsureCA(dataRoot); err != nil {
 			log.Fatalf("Failed to provision instance CA: %v", err)
 		}
+		// Dev mode: provision the identities the docker-compose.dev/debug.yaml
+		// peers bind-mount at /dcntrlized/pki, BEFORE the shared infrastructure
+		// boots — dcntrlized-auth's mTLS listener refuses to start without its
+		// identity. Must run before EnsureDatabaseRunning/EnsureAuthRunning.
+		if env.IsDev() {
+			devboot.EnsureIdentities()
+		}
 		if err := cache.LoadInstalledContainers(); err != nil {
 			log.Fatalf("Failed to load installed containers: %v", err)
 		}
@@ -77,6 +86,12 @@ func main() {
 		if err := libcontainers.EnsureAuthRunning(ctx); err != nil {
 			log.Printf("Warning: failed to ensure shared auth service: %v", err)
 		}
+		// Dev mode: approve the known fleet in the auth trust store once the
+		// auth service is up, so the compose-managed satellites' mTLS proxies
+		// are authorized (the decision a first contact would pend).
+		if env.IsDev() {
+			devboot.ApproveFleet(ctx)
+		}
 		cache.ReconcileContainers(ctx, dc)
 		go cache.WatchContainers(ctx, dc)
 	}