feat(security): instance CA + service identity certs (M1)

- lib/pki: root CA provisioning on first run (~/.dcntrlized/pki/), per-service
  leaf identity issuance (90d, refreshed at start), revocation with CRL
- main: EnsureCA on startup
- start: inject CA + identity mounts and AUTH_* mTLS env into compose services
- uninstall: revoke the service's cert (CRL entry published)

src/main.go

@@ -26,8 +26,9 @@ import (
 	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/actions"
 	"git.dcntrlized.org/Dcntrlized/Maestro/handlers/containers"
 	handlers "git.dcntrlized.org/Dcntrlized/Maestro/handlers/registry"
-	libcontainers "git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
+		libcontainers "git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
+	"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
 )
 
 //go:embed all:frontend/dist
@@ -52,6 +53,16 @@ func main() {
 		if err := libcontainers.EnsureDataRoot(); err != nil {
 			log.Fatalf("Data root check failed: %v", err)
 		}
+		// Provision the instance CA on first run (security theme M1). The CA is
+		// the trust anchor for every peer edge on dcntrlized_net; services get
+		// their identity certs from it at start/install.
+		dataRoot, err := libcontainers.DataRoot()
+		if err != nil {
+			log.Fatalf("Failed to resolve data root: %v", err)
+		}
+		if _, err := pki.EnsureCA(dataRoot); err != nil {
+			log.Fatalf("Failed to provision instance CA: %v", err)
+		}
 		if err := cache.LoadInstalledContainers(); err != nil {
 			log.Fatalf("Failed to load installed containers: %v", err)
 		}