// Package security provides certificate authority, CSR signing, TLS
// configuration, and rotation helpers for orca's mTLS transport.
//
// The CA model is internal + operator-mediated (per PROJECT.md D-011, D-012):
//
//   - The bootstrap node runs CAInit(dir) to mint a self-signed CA and persist
//     ca.crt (0644) + ca.key (0600). Mode enforcement is intentional — REQ-033
//     requires the daemon to refuse to start if the file modes are wrong.
//   - Operators copy ca.crt to peers out-of-band.
//   - Peers run GenerateCSR to produce a CSR + key, ship the CSR to the CA
//     node, which calls SignCSR to produce a server cert. The peer verifies
//     the on-disk CA cert's SHA-256 fingerprint at `node join` time against
//     a pinned value (REQ-026) — fail fast on CA mismatch (D-014).
//
// All certificate operations use the Go standard library (no external
// crypto deps) per the v0.2 plan's "no new direct deps for P01" rule.
package security