Phase B — mTLS as primary trust-level path (Cowboy TLS + real-CA fixture) #97

Weeks 3–5. Gateway derives X-Trust-Level from mTLS client certs; Cowboy TLS config; real-CA test fixture. This is the core security gap. Fills the trust-level-primary-path hole ADR-0004 names.

Parent: standards#91 (ADR-0004 phase B). Single-channel: do not work out of phase order; A→B→C→D→E.