gleep fixes mtls and stuff

.env.example

@@ -17,6 +17,10 @@ KEYWARDEN_CA_KEY_DIR=/var/lib/keywarden/ca-keys
 # Optional legacy global fallback token for agents.
 # Preferred model is per-agent token issued during /agent/enroll.
 # KEYWARDEN_AGENT_API_TOKEN=
+# Runtime compatibility switch:
+# true  = allow bearer fallback when mTLS headers are absent (default)
+# false = strict mTLS-only runtime auth
+# KEYWARDEN_AGENT_RUNTIME_ALLOW_TOKEN_FALLBACK=true
 
 # Database
 KEYWARDEN_POSTGRES_DB=keywarden