docs: mTLS configuration reference and TLS API update

[phillipleblanc]

Adds documentation for the new mutual TLS (mTLS) feature (Enterprise).

reference/spicepod/runtime.md

New fields under runtime.tls:

• client_auth_mode — none (default) / request / required
• client_auth_ca_file — PEM CA bundle path (hot-reloaded)
• client_auth_ca — inline PEM CA (or `${ secrets:... }`)

Includes Enterprise admonition, mode behavior table, and example YAML.

api/tls/index.md

New "Mutual TLS (mTLS)" section covering:

• Enabling mTLS via spicepod.yaml and CLI flags
• Client auth mode table
• Connecting with client certs (cURL and spice sql with --client-tls-certificate-file / --client-tls-key-file)
• Probe/metrics access behavior
• Client CA hot-reload
• Link to the new mTLS cookbook recipe

[github-actions]

✅ Pull with Spice Passed

Passing checks:

• ✅ Title meets minimum length requirement (10 characters)
• ✅ Has at least one of the required labels: area/blog, area/docs, area/cookbook, dependencies
• ✅ No banned labels detected
• ✅ Has at least one assignee: phillipleblanc

[github-actions]

🚀 deployed to https://48909a5d.spiceai-org-website.pages.dev

[github-actions]

🚀 deployed to https://e085d92b.spiceai-org-website.pages.dev