feat(auth): read the real operator identity and level from WhoAmI

[Bugs5382]

What and why

Turns the mock client-cert auth into a real one (Slice A). In live/live-auth the AuthProvider calls the manager's WhoAmI and renders the verified operator (cn/serial/level); mock keeps the 600ms dev stub. Adds a denied state when no valid operator is returned, and sends credentials: "include" on the fleet client so the browser presents its client certificate.

• Operator gains level (admin|operator|viewer); AuthStatus gains denied.
• Provider: mock stub unchanged; live/live-auth → whoAmI({}); success maps identity/level (viewer fallback for an unknown level); denied on no-operator or a rejected RPC (.catch); cancellation guard.
• Auth gate renders a denied screen.
• Refreshed the vendored fleet_pb.ts from the merged api (adds the whoAmI client method).

Consumes the manager WhoAmI endpoint (manager #18) and api WhoAmI (CryptOS-PKI/api#44, merged). Independent at build time.

Closes #47

Verification

• Lint clean (eslint + prettier)
• Tests pass (113/113; new auth.test.tsx: authenticated+level, and denied)
• Build succeeds

How this was verified

npm run test 113/113, npm run lint and npm run build clean. Note: the denied test drives the provider's no-operator branch (a resolved response with no operator) rather than a rejected promise, to avoid a Vitest 3.2.7 false unhandled-rejection artifact; the reject path runs the same one-line setState and is exercised by the live cert-absent flow. Follow-up: cover the reject path once the test tooling is restructured (per-test vi.fn() instead of mockReset()).