Configure the ProxyAdminService listeners and peer discovery

[liam-lowe]

Adds a proxyAdmin block to the config. It carries a loopback listener for local operator queries, an optional peer listener that serves the other pods of this deployment, and peer discovery by DNS or a static address list.

Validation composes through S2SProxyConfig.Validate(). A bad value surfaces as proxyAdmin.peer: tls.caServerName: is required and names the field that caused it. Only configuration that can never work is rejected here. Failures that depend on the environment are left to runtime, such as a port already in use or a name that does not resolve.

Three of those checks cover a listener that would start up looking configured while being weaker than it reads:

• proxyAdmin.listenAddress must be loopback. That listener has no TLS and no authorization. Off host it publishes the deployment's topology to anything that can reach it. The error names proxyAdmin.peer as the listener that authenticates its callers.
• proxyAdmin.peer.tls.caServerName is required whenever peer TLS is enabled. Siblings are dialed by IP. Without it the dial has no name to verify the sibling certificate against. The failure lands inside encryption.GetClientTLSConfig rather than at load.
• proxyAdmin.peer.tls.skipCAVerification must be false. GetClientTLSConfig assigns it to InsecureSkipVerify. Every sibling this pod dials would go unverified while the config still reads as TLS secured.

Each discovery provider gets its own typed block, selected by name. Every layered configuration tool in this stack deep-merges and cannot delete keys. Switching provider through a Helm override leaves the previous provider's block behind. It has to be inert. A single flat options map could not be switched at all under strict decoding.

ProxyAdmin is a value rather than a pointer because nil and an empty listen address already mean the same thing.

AllowedMethods.ProxyAdmin is deliberately not resolved through auth.AccessControl, whose IsAllowed returns true for an empty list. That fail-open default is a compatibility promise the replication ACL depends on. Repeating it here would make the natural spelling of "off" the widest possible setting.

Nothing reads this config yet. TestProxyAdminConfig exercises it through LoadConfig and S2SProxyConfig.Validate(). The composition into the parent validator is covered rather than assumed.

Testing

• make lint: 0 issues.
• go test ./...: every package passes.
• TestProxyAdminConfig added: 9 subtests, one of which is a table of 12 configurations that must be rejected. Each asserts the message text rather than only that an error came back. The field path is the point.