test(stack): exercise Router Nacos HTTP and gRPC mTLS

[XnLemon]

Problem

Core supports explicit private-CA TLS and mTLS for the A2A Router's Nacos HTTP and gRPC transports, but the product Stack still configures Router-to-Nacos traffic as plaintext. Current product acceptance proves secure Provider registration only, so the deployed Register -> Discover -> Install -> Invoke -> Record path does not yet prove the Router's secure Config Center read, initial Naming snapshot, and lifecycle watch together.

Ownership

This is a NeKiro-Stack deployment and product-acceptance slice. Core remains the owner of Router configuration and transport semantics. Stack owns ephemeral PKI generation, secure Nacos fixture assembly, immutable component pins, and product E2E success criteria.

Scope

• Generate ephemeral private-CA, server, and Router client material before the Router starts.
• Do not commit certificates or private keys.
• Terminate authenticated HTTPS and gRPC mTLS in a Stack-owned Nacos proxy fixture.
• Configure the Router's Nacos API origin and gRPC target to use only the secure fixture.
• Mount the same ephemeral client identity into the Router.
• Preserve Provider A TLS and Provider B mTLS registration acceptance.
• Prove that Config Center binding reads, initial Naming snapshots, watch updates, runtime removal/replacement, Router invocation, nested calls, and Ledger recording still pass.
• Add observable acceptance evidence that both secure HTTP and secure gRPC boundaries were actually reached.
• Document local/CI operation and the exact trust boundary.

Failure semantics

• no system trust roots
• no plaintext downgrade
• no alternate Nacos endpoint
• no retry or reconnect introduced by this slice
• no stale-success fallback
• no certificate path, PEM, private-key, or credential leakage

Fallback delta: removed 0, retained 0, added 0, net 0
Added fallback evidence: none

Acceptance

• Stack quality, manifest, compose, backend, browser, security, and required pass.
• Router starts only with valid private-CA mTLS material.
• Backend acceptance observes at least one authenticated HTTPS request and one authenticated gRPC connection from Router.
• The full A/B lifecycle and replacement/watch acceptance remain green.
• Tracked source contains no generated certificate or private-key material.

[XnLemon]

Implemented in #12 and validated by CI run 31393144769:

• quality: passed
• manifest: passed
• compose base + secure override: passed
• backend: passed
• browser: passed
• security: passed
• required: passed

The backend acceptance observed authenticated Router HTTP reads and at least one authenticated gRPC watch connection while preserving Provider TLS/mTLS registration, runtime replacement, nested A/B invocation, cancellation, and Ledger verification.

Fallback delta: removed 0, retained 0, added 0, net 0
Added fallback evidence: none