security: require TLS and per-peer NATS authentication

[fedoseevstanislav]

Summary

• centralize NATS connection security and reject non-loopback plaintext, URL-embedded credentials, conflicting auth methods, and unverifiable TLS/IP identities
• add TLS plus per-agent username/password support to the broker, daemon, MCP server, OpenClaw bridge, A2A bridge, demos, runner, and invite/join workflow
• make new and updated agent credential files owner-only
• replace the Kubernetes shared-token example with TLS and subject-scoped ACLs; bind the Docker Compose plaintext listener to loopback
• add a migration runbook, unit coverage, and an isolated live TLS/ACL integration proof

This intentionally makes existing non-loopback nats:// configurations fail closed. Operators must coordinate the broker and peer credential cutover described in docs/nats-transport-security.md.

Tracks fedoseevstanislav/ops#726.

Verification

• npm test
• npm audit: 0 vulnerabilities
• isolated Linux-host integration with NATS Server 2.14.2:
  • allowed peer delivery succeeds
  • forbidden subject publish raises a permission violation
  • retired shared token is rejected
  • wrong certificate server name is rejected