feat(mesh): enable peer mTLS from key_management.cache.mesh.peer_tls

[rickcrawford]

What

Makes the mesh peer-mTLS transport (mechanism merged in #557) operator-configurable from sb.yml. With this, an operator turns on mutual TLS for the mesh cache fabric with:

key_management:
  cache:
    mesh:
      peer_tls:
        cert_file: /etc/sbproxy/mesh/node.crt
        key_file:  /etc/sbproxy/mesh/node.key
        ca_file:   /etc/sbproxy/mesh/ca.crt
        server_name: sbproxy-mesh   # optional, this is the default

Every inbound mesh connection must then present a CA-signed client certificate, and every outbound connection presents this node's certificate, both verified against the CA. Unset keeps the plaintext transport.

Layers wired

• sbproxy-config: MeshPeerTlsConfig (cert_file/key_file/ca_file/server_name) on MeshClusterConfig; config JSON schema regenerated.
• sbproxy-core key_plane: reads the PEM files (fail-closed on a read error) into PeerTlsParams on BootstrapConfig.
• sbproxy-mesh bootstrap: builds the rustls acceptor + connector and threads them into TransportServer::start_with_security and TransportClientPool::with_security (which now constructs TLS-capable PeerClients).

Tests

• The end-to-end mTLS roundtrip + handshake tests from feat(mesh): mutually-authenticated TLS for the peer transport #557 still pass; TransportClientPool now carries the connector to every client it builds.
• sbproxy-config (293) and sbproxy-mesh (416) lib suites pass; sbproxy-core lib suite passes; clippy -D warnings clean on config + mesh; config schema regenerated and committed (CI's schema check will confirm it matches).

A misconfigured cert/key/CA fails the mesh bootstrap rather than silently downgrading the cluster to plaintext.