The mTLS certificate chain validates externally, but the internal proxy strips the client certificate header on HTTP/2 upgrade and backend auth fails only there

Transport security is intact, yet identity propagation across layers is not.