Constant TLS_DIR_NAME 

pub const TLS_DIR_NAME: &str = "tls";

XDG subdirectory for TLS material (mTLS client certs, ACME account/certs).

Layout (all under config dir, mode 0o600 for secrets):

• tls/mtls/<name>/cert.pem + key.pem
• tls/acme/account.json
• tls/acme/<domain>/cert.pem + key.pem + order.json (pending)