bug(cli): --gateway-insecure skips client certificate presentation on mTLS gateways

[zanetworker]

Summary

--gateway-insecure (or OPENSHELL_GATEWAY_INSECURE=true) disables TLS server certificate verification, but also drops client certificate presentation. This breaks mTLS gateways that require client certs.

Semantically, "insecure" should mean "skip server verification" (like curl -k), not "don't authenticate myself."

Root Cause

In crates/openshell-cli/src/tls.rs, the insecure path calls:

pub fn build_insecure_rustls_config() -> Result<rustls::ClientConfig> {
    let config = rustls::ClientConfig::builder()
        .dangerous()
        .with_custom_certificate_verifier(std::sync::Arc::new(InsecureServerCertVerifier))
        .with_no_client_auth();  // <-- drops client identity
    Ok(config)
}

The .with_no_client_auth() should be .with_client_auth_cert(cert_chain, key) using the certs from the gateway's mtls directory.

Reproduction

# Works: client cert presented
unset OPENSHELL_GATEWAY_INSECURE
openshell provider list
# Success

# Fails: client cert dropped
OPENSHELL_GATEWAY_INSECURE=true openshell provider list
# Error: transport error / connection closed

# Proof via rustls debug:
OPENSHELL_GATEWAY_INSECURE=true RUST_LOG=debug openshell provider list 2>&1 | grep client
# DEBUG rustls::client::common: Client auth requested but no cert/sigscheme available

Expected Behavior

--gateway-insecure should:

• Skip server certificate verification (current behavior, correct)
• Still load and present client certificates from ~/.config/openshell/gateways/<name>/mtls/ (missing)

Environment

• openshell 0.0.83
• macOS (Apple Silicon)
• Local mTLS gateway via brew services start openshell