feat: mtls handshake metrics + yoq cert service cli

[kacy]

summary

fourth PR-5 chunk (after #440, #441, #442). lands the two reviewer-
friendly extras that don't depend on the L7 data-plane refactor:

• yoq_service_mtls_handshakes_total{side, outcome} counter surfaced
  in /metrics
• yoq cert service <name> cli — read-only inspector for the
  raft-replicated leaf cert

both immediately useful even before the proxy switches to mtls for
outbound traffic.

what's in here

• tls/mtls_metrics.zig — four-bucket mutex-protected counter
  (client/server × ok/failed) plus tests
• client_session.doHandshake bumps the client side (always; the
  client only runs when ca_cert_pem is set in the caller's options)
• session_runtime.acceptServerHandshake bumps the server side only
  when MtlsOpts was passed — keeps the existing plain-TLS
  termination path out of the counter
• metrics_routes.zig emits the four bucket lines next to the
  existing yoq_service_mtls_* family from feat: per-service mtls leaf issuance + rotation (shadow) #434
• tls/cli/service_cert_command.zig + commands.zig wiring +
  usage-string update. text and --json output paths.

what isn't in this PR (and why)

the L7 reverse proxy's outbound mTLS swap — i.e. teaching
forwardSingleAttempt to consume client_dial.Outcome.session instead
of a raw fd — is the one PR-5 piece intentionally split out. doing it
cleanly requires:

• adding peer_mode to ServiceSnapshot / Upstream (cross-cutting)
• a parallel pool layer for sessions (each carries encryption state
  and sequence counters — can't be pooled as bare fds)
• updating forwardSingleAttempt's read/write/pool/discard paths to
  match on the union

that's its own design pass + load-bearing review. landing it here
would either be unsafe (sharing pools across encryption states) or
hidden inside a 1500-LOC PR. the helper from #442 (client_dial.dial)
is the clean target it will consume; the metrics counters in this PR
will start producing real data the moment it lands.

verification

• full unit suite green (2231 passed, 0 failed)
• fmt + panic_audit clean
• mtls_metrics round-trip tested (4-way bucket increments)
• the e2e mTLS round-trip tests in feat: tls 1.3 client session driver #438/feat: server-side mtls — certificaterequest + client-cert verify #439 still pass — confirms the
  metric hooks didn't disturb the handshake

still no auto-merge — security-sensitive instrumentation.