v0.1.18

What's Changed

• Bearer token authentication — bearer_authenticate, bearer_authenticate_static, and chain_authenticate factories for composing HTTP auth callbacks
• Mutual TLS (mTLS) authentication — client certificate auth via proxy-forwarded headers:
  • mtls_authenticate — generic factory with custom certificate validation
  • mtls_authenticate_fingerprint — certificate fingerprint lookup
  • mtls_authenticate_subject — Subject CN extraction with optional allowlist
  • mtls_authenticate_xfcc — Envoy x-forwarded-client-cert header parsing (no extra deps)
• New vgi-rpc[mtls] optional dependency (cryptography) for PEM-based factories
• Documentation for mTLS authentication with proxy configuration examples (nginx, AWS ALB, Envoy)