Support explicit direct-mTLS and trusted-reverse-proxy authentication
modes with mutually authenticated backend transport.
Keep proxy and end-client principals separate, validate forwarded
certificates independently, and enforce narrowly scoped forwarding
authority for RFC 9440 and NGINX escaped-PEM profiles.
Add the mutually authenticated administrative HTTPS server with strict
typed JSON, bounded request execution, multi-authority authorization,
approval enforcement, safe auditing and finite shutdown.
Reuse one long-lived realm and PKI session without duplicating backend
authority or operation semantics.
