Revoke a removed node's certificate, and require --api-client with a mirror's mutual TLS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/install.md

@@ -269,17 +269,20 @@ it can start downloads and delete models, and only the control plane needs it.
 The split is what lets you lock the second one down without re-certifying every
 agent that fetches from the first.
 
-Give the management port the cluster's own CA and it takes client certificates:
+Give the management port the cluster's own CA and it takes client certificates —
+the control plane's, named with `--api-client`, and no other. The same CA signs
+every node's certificate, so the name is required: without it any node, a
+removed one's included, could delete models.
 
 ```
 llmgw mirror serve --dir /srv/models --base http://models.internal:8081 \
   --tls-ca /etc/llmgw/ca.pem \
-  --tls-cert /etc/llmgw/mirror.pem --tls-key /etc/llmgw/mirror-key.pem
+  --tls-cert /etc/llmgw/mirror.pem --tls-key /etc/llmgw/mirror-key.pem \
+  --api-client control-plane
 ```
 
-Without those three flags the management port is open to anyone who can reach
-it, and the mirror says so in its own log at every start rather than letting you
-find out later.
+Without those flags the management port answers this machine only, and the
+addresses given with `--api-allow`.
 
 ### The layout