test(stack): exercise Router Nacos HTTP and gRPC mTLS

[XnLemon]

Closes #11

Summary

• add a Stack-owned secure Nacos fixture with ephemeral private-CA generation
• terminate Router Nacos HTTP and gRPC traffic with required mTLS
• mount the generated Router client identity read-only and remove the plaintext Router transport configuration
• preserve the existing Provider TLS/mTLS registration fixtures using the same ephemeral PKI
• assert that Router completed secure Config Center/Naming HTTP reads and established the secure gRPC watch
• build the fixture as an immutable Stack image during exact component preparation
• document local generation, ownership, and acceptance evidence

Product path

The backend Stack now exercises:

Register -> Discover -> Install -> secure HTTP snapshot -> secure gRPC watch -> Router Invoke -> Record

Provider A continues to register through TLS. Provider B and its replacement continue to register through mTLS. Managed A/B calls, replacement recovery, nested lineage, cancellation, and Ledger checks remain part of the same acceptance suite.

Validation

• go mod tidy
• go build ./...
• go test -count=1 ./...
• go test -race ./...
• go vet ./...
• git diff --check
• docker compose --file compose.yaml config --quiet
• unit acceptance for HTTP mTLS rejection/forwarding
• unit acceptance for gRPC mTLS, h2 negotiation, and byte forwarding

Docker Desktop was unavailable locally, so the full backend/browser container assembly is delegated to this PR's required CI.

Security and fallback

No certificate or private key is committed. Generated material exists only in the caller-owned runtime directory and is mounted read-only.

Fallback delta: removed 0, retained 0, added 0, net 0
Added fallback evidence: none

There is no system-root use, plaintext downgrade, alternate endpoint, retry, reconnect, or stale-success fallback introduced here.