feat(devboot): remove dev fleet pre-approval

Dev now runs the real trust-store flow end to end: satellites boot with the
instance-CA identities Maestro issues (devboot.EnsureIdentities), but their
first mTLS contact records a pending authorization and is refused (403) until
the owner approves via /api/peers. The ApproveFleet shortcut is gone, along
with the authmgmt dependency in devboot.

src/main.go

@@ -86,12 +86,9 @@ func main() {
 		if err := libcontainers.EnsureAuthRunning(ctx); err != nil {
 			log.Printf("Warning: failed to ensure shared auth service: %v", err)
 		}
-		// Dev mode: approve the known fleet in the auth trust store once the
-		// auth service is up, so the compose-managed satellites' mTLS proxies
-		// are authorized (the decision a first contact would pend).
-		if env.IsDev() {
-			devboot.ApproveFleet(ctx)
-		}
+		// No dev pre-approval: the fleet's first mTLS contact records a pending
+		// authorization and is refused (403) until the owner approves it via
+		// /api/peers — dev runs the real trust-store flow.
 		cache.ReconcileContainers(ctx, dc)
 		go cache.WatchContainers(ctx, dc)
 	}