Function admin_mtls_server_config 

pub fn admin_mtls_server_config(
    tls: &AdminTlsConfig,
) -> Result<ServerConfig, TlsError>

Build the mTLS-ONLY rustls::ServerConfig for the admin listener (DW-022, decision 6). Client certificates are REQUIRED and must chain to the CA in client_ca_file (WebPkiClientVerifier over a root store loaded from that PEM); the server presents the single cert/key pair. The key is checked against the leaf exactly like dataplane termination, so a torn pair cannot boot. ALPN advertises HTTP/1.1 only — the admin API is a small request/response surface.