v1.5.1 - mTLS fail-open and path RBAC

Three mTLS defects, all older than 1.5.0, found while bringing the
documentation in line with 1.5.0. Mechanism details are withheld until
operators have had time to upgrade. If you use client-certificate
authentication, upgrade before anything else.

Security

• Client-certificate "fail open" did not verify a presented certificate.
  The setting was meant to let a client with no certificate through while
  still validating one that is presented; it validated nothing. Because the
  certificate subject is passed onward, an affected route could treat a
  client as an identity it had not proven. Fail-open now requires a presented
  certificate to chain to the configured CA. The setting is super_admin
  break-glass and off by default.

• A client could supply the header that carries the certificate subject.
  It is now removed from every inbound request before anything else runs.

Fixed

• Path-based mTLS role checks denied every request, including legitimate
  ones. The stored subject and the value the proxy sends were compared in
  two different formats, so the lookup never matched and every rule-covered
  path returned 403. Both forms now match, so subjects already stored keep
  working. The existing test passed only because its fixture used a value the
  issuing path cannot produce.