docs(auth): clarify gateway mTLS behavior

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-core/src/config.rs

@@ -374,13 +374,13 @@ pub struct OidcConfig {
     pub scopes_claim: String,
 }
 
-/// mTLS user authentication for local, single-user gateways.
+/// mTLS user authentication for gateway users.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct MtlsAuthConfig {
     /// When true, the gateway maps a verified TLS client certificate into a
-    /// user principal. Keep disabled for Kubernetes deployments because
-    /// Kubernetes sandbox pods and external users must not share user auth.
+    /// user principal. Sandbox and supervisor clients use bearer identity, so
+    /// this setting is independent of the selected compute driver.
     #[serde(default)]
     pub enabled: bool,
 }

crates/openshell-server/src/multiplex.rs

@@ -856,8 +856,9 @@ where
 /// Once sandbox authentication is configured, callers must present an
 /// explicit credential for authenticated gRPC methods. Missing bearer auth
 /// is promoted to an mTLS user only when `mtls_auth.enabled` is configured
-/// for local single-user gateways, or to an unsafe local developer user when
-/// `auth.allow_unauthenticated_users` is explicitly enabled.
+/// and the connection presents a verified client certificate, or to an unsafe
+/// local developer user when `auth.allow_unauthenticated_users` is explicitly
+/// enabled.
 ///
 /// When neither OIDC nor sandbox credentials are configured (a barebones
 /// dev gateway), the chain is left as `None` so the router short-circuits