feat(ios): device client-cert mTLS — ClientTLS package, transport wiring, install UX (C-iOS)

- ios/Packages/ClientTLS: SecIdentity wrapper, PKCS12 importer (typed errors), keychain store
  (AfterFirstUnlockThisDeviceOnly), pure MutualTLSChallengeResponder truth table, cross-platform
  X.509 DER summary. 14/14 tests.
- Both transports (SessionCore URLSessionTermTransport, App URLSessionHTTPTransport) + SessionThumbnail
  take a lazy @Sendable ()->ClientIdentity? provider: WS resolves per-connect, HTTP per client-cert
  challenge, so a freshly-imported cert applies without an app relaunch. AppEnvironment injects
  { store.loadedIdentityOrNil() }.
- ClientCertScreen (.fileImporter([.pkcs12]) + passphrase -> import -> keychain), reachable via a
  设备证书 entry in SessionListScreen.hostMenu. PairingViewModel gates tunnel-host probes on cert
  presence and re-maps mTLS-reject to a clientCertRejected message.
Verified: ClientTLS 14/14, SessionCore 93/93, xcodegen + xcodebuild BUILD SUCCEEDED.

ios/App/WebTerm/Components/SessionThumbnail.swift

@@ -1,4 +1,5 @@
 import APIClient
+import ClientTLS
 import Foundation
 import os
 import SwiftUI
@@ -225,12 +226,19 @@ final class SessionThumbnailPipeline {
         cache = SessionThumbnailCache(maxEntries: maxCacheEntries)
     }
 
-    /// 生产装配：共享一个 ephemeral URLSession（preview 字节可能含屏上密钥，
-    /// 内存缓存 only——同 T-iOS-19 对 RO GET 的裁定）。
+    /// 生产装配：ephemeral URLSession（preview 字节可能含屏上密钥，内存缓存
+    /// only——同 T-iOS-19 对 RO GET 的裁定），并携带 C-iOS-2 的设备证书身份，
+    /// 这样对隧道主机的预览取数也能通过 mTLS（否则缩略图会被 nginx 拒握手）。
+    /// 身份经 provider 每次握手时按需从 keychain 载入（MEDIUM 无需重启修复：
+    /// 中途导入的证书下次取数即生效；缺证=nil，对本地主机无副作用）。
     static func live() -> SessionThumbnailPipeline {
-        SessionThumbnailPipeline(
+        let identityStore = KeychainClientIdentityStore()
+        let transport = URLSessionHTTPTransport(identityProvider: {
+            identityStore.loadedIdentityOrNil()
+        })
+        return SessionThumbnailPipeline(
             loader: { request in
-                try await APIClient(endpoint: request.endpoint, http: liveTransport)
+                try await APIClient(endpoint: request.endpoint, http: transport)
                     .preview(id: request.sessionId)
             },
             renderer: { data, cols, rows in
@@ -239,8 +247,6 @@ final class SessionThumbnailPipeline {
         )
     }
 
-    private static let liveTransport = URLSessionHTTPTransport()
-
     /// 取（或渲染）一张缩略图。永不抛错：任何失败显式降级为 `.placeholder`
     /// （占位图就是缩略图的错误 UI；细节进内部日志，绝不静默无痕）。
     func thumbnail(for request: SessionThumbnailRequest) async -> SessionThumbnailImage {