feat(pki-server): support trusted reverse-proxy authentication

Support explicit direct-mTLS and trusted-reverse-proxy authentication
modes with mutually authenticated backend transport.

Keep proxy and end-client principals separate, validate forwarded
certificates independently, and enforce narrowly scoped forwarding
authority for RFC 9440 and NGINX escaped-PEM profiles.

docs/pki-server-production-example.json

@@ -1,5 +1,5 @@
 {
-  "version": 1,
+  "version": 2,
   "serverName": "zeroecho-admin",
   "realm": {
     "realmId": "production",
@@ -56,7 +56,8 @@
     "maximumBodyBytes": 1048576
   },
   "authentication": {
-    "mappings": [{
+    "mode": "DIRECT_MTLS",
+    "directClientMappings": [{
       "mappingId": "bootstrap-administrator",
       "principalId": "bootstrap-admin",
       "certificateSha256": "0000000000000000000000000000000000000000000000000000000000000000"