Admin API auth for remote external mode (mTLS / secured admin endpoint)

[gsmlg]

Problem

config :caddy, admin_url: supports plain TCP (http://host:2019) but there is no TLS, mutual-TLS, or token support in Caddy.Admin.Transport / Caddy.Admin.Request.

Caddy's remote admin endpoint (admin.identity / admin.remote) requires mutual TLS. Without client-cert support, remote management with this library is effectively insecure-only — fine for localhost/unix-socket, unusable for managing Caddy across hosts.

Proposal

config :caddy,
  admin_url: "https://caddy-host:2021",
  admin_tls: [
    certfile: "/path/client.crt",
    keyfile: "/path/client.key",
    cacertfile: "/path/ca.crt"
  ]

Wire the TLS options through the transport layer for https:// admin URLs.