test coverage improvements; mTLS enforcement; agent broke :(

agent/README.md

@@ -78,7 +78,8 @@ Do not prefill `server_id` or `agent_api_token` with placeholders; those are wri
 
 If the Keywarden server uses a private TLS CA, set `server_ca_path` (or `KEYWARDEN_SERVER_CA_PATH`) to the CA PEM file so the agent can verify the server certificate.
 `agent_api_token` is issued by `/agent/enroll` and persisted into `agent.json` automatically.
-Use the raw token value (no `Bearer ` prefix). If `KEYWARDEN_AGENT_API_TOKEN` env var is set, it overrides `agent_api_token` in `agent.json`.
+Runtime authentication is mTLS-first; `agent_api_token` is retained for backward compatibility during migration.
+If used, supply the raw token value (no `Bearer ` prefix). If `KEYWARDEN_AGENT_API_TOKEN` env var is set, it overrides `agent_api_token` in `agent.json`.
 When no `log_sources` are configured, the agent defaults to journald collection via `go-systemd/sdjournal` and backfills from the start of the current boot on first sync.
 If journald is unavailable, the agent falls back to common system log files (`/var/log/auth.log`, `/var/log/secure`, `/var/log/syslog`, `/var/log/messages`).
 

agent/cmd/keywarden-agent/main.go

@@ -108,7 +108,9 @@ func runOnce(ctx context.Context, apiClient *client.Client, cfg *config.Config)
 func logAgentUnauthorizedHint(err error) {
 	var statusErr *client.HTTPStatusError
 	if errors.As(err, &statusErr) && statusErr.StatusCode == 401 {
-		log.Printf("agent auth failed (401): ensure agent_api_token matches the enrollment-issued token for this server (raw token only; no 'Bearer ' prefix)")
+		log.Printf(
+			"agent auth failed (401): runtime auth is mTLS-first; verify this agent is using the enrolled client cert/key, server_id matches enrollment, and traffic is routed through nginx /api/v1/agent/ so TLS client-cert headers are forwarded. Bearer agent_api_token is optional compatibility metadata, not the primary auth path.",
+		)
 	}
 }
 

agent/internal/client/client.go

@@ -48,9 +48,6 @@ func New(cfg *config.Config) (*Client, error) {
 		return nil, errors.New("server url is required")
 	}
 	agentToken := normalizeAgentToken(cfg.AgentAPIToken)
-	if agentToken == "" {
-		return nil, errors.New("agent api token is required (set agent_api_token or KEYWARDEN_AGENT_API_TOKEN)")
-	}
 	cert, err := tls.LoadX509KeyPair(cfg.ClientCertPath(), cfg.ClientKeyPath())
 	if err != nil {
 		return nil, fmt.Errorf("load client cert: %w", err)