mTLS client identity maps to the wrong tenant

Certificates are valid, yet authorization fails because the parser extracts a different identity field than the policy engine expects.