feat(server): separate HTTPS from mTLS authentication

[sjenning]

Summary

• Make --tls-client-ca optional when TLS is enabled, decoupling HTTPS encryption from mTLS client certificate authentication
• Enable HTTPS + OIDC-only deployments where the gateway serves encrypted traffic without requiring client certificates
• Add startup warning when neither mTLS nor OIDC is configured (no auth mechanism)

Related Issue

N/A

Changes

• openshell-core/config.rs: Change TlsConfig.client_ca_path from PathBuf to Option<PathBuf>
• openshell-server/tls.rs: Branch TlsAcceptor::from_files — Some(ca) builds mTLS verifier, None uses with_no_client_auth()
• openshell-server/cli.rs: Remove runtime error requiring --tls-client-ca; add HTTPS-only log message and no-auth warning
• openshell-server/lib.rs: Pass client_ca_path.as_deref() to from_files
• openshell-server/compute/vm.rs: Wrap test client_ca_path values in Some()
• Helm statefulset.yaml: Conditionally include client-ca env var, volume mount, and volume
• Helm values.yaml: Document that clientCaSecretName is optional

Testing

• mise run pre-commit passes
• All 7 edge_tunnel_auth integration tests pass (including new https_only_no_client_cert_required)
• All 4 multiplex_tls_integration tests pass
• Manual: start gateway with --tls-cert and --tls-key only, verify HTTPS-only mode works with OIDC

Checklist

• Conventional commit format
• No secrets committed
• Backward compatible (existing deployments with --tls-client-ca work identically)
• Tests added for new behavior

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.