fix(gateway): persist mitmproxy CA on the host, not a named volume (#450)

The shared gateway self-generates a mitmproxy CA that every bottle installs
to trust its TLS interception. It was persisted on a Docker named volume,
which survives `docker rm` but is silently wiped by `docker volume prune` /
`docker system prune --volumes` during routine host maintenance. When that
happens the gateway mints a fresh CA on restart, and every already-running
bottle fails the TLS handshake even after it re-resolves and reconnects to
the moved gateway — a re-attachment blocker distinct from #443/#445.

Move CA persistence to a host bind-mount under the app-data root
(`bot_bottle_root()/gateway-ca`, via `host_gateway_ca_dir()`), mirroring how
the shared DB and control-plane token already live on the host. Docker never
prunes a path under the root, and it stays inspectable + rotatable from the
host. mitmproxy already adopts an existing CA and generates one only on first
run, so the bind-mount gives adopt-existing/generate-on-first-run for free.

Add an explicit rollover path: `rotate_gateway_ca()` clears the persisted CA
so the next start remints it, and `python -m bot_bottle.orchestrator.rotate_ca`
wires that together with dropping the running gateway container (whose
mitmproxy still holds the old CA in memory). Rotation stays an operator action
— it doesn't auto-re-provision running bottles, which re-attach to pick up the
new anchor.

Scope: the Docker infra/gateway path (the "infra container" in the report).
The macOS (`container`-only volume) and Firecracker (VM-attached ext4) backends
persist the CA differently and are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_rotate_ca.py

@@ -0,0 +1,59 @@
+"""Unit: the `rotate_ca` one-shot CLI (issue #450). Docker mocked."""
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+from bot_bottle.orchestrator import rotate_ca
+from bot_bottle.orchestrator.gateway import GATEWAY_NAME
+from bot_bottle.orchestrator.lifecycle import INFRA_NAME
+from bot_bottle.paths import host_gateway_ca_dir
+from tests.unit import use_bottle_root
+
+_RUN = "bot_bottle.orchestrator.rotate_ca.run_docker"
+
+
+def _proc(returncode: int = 0, stdout: str = "", stderr: str = "") -> Mock:
+    return Mock(returncode=returncode, stdout=stdout, stderr=stderr)
+
+
+class TestRotateCaCli(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self.addCleanup(use_bottle_root(Path(self._tmp.name)))
+
+    def test_clears_ca_and_drops_gateway_containers(self) -> None:
+        ca_dir = host_gateway_ca_dir()
+        (ca_dir / "mitmproxy-ca.pem").write_text("x")
+        (ca_dir / "mitmproxy-ca-cert.pem").write_text("x")
+
+        calls: list[list[str]] = []
+
+        def fake(argv: list[str], **_kw: object) -> Mock:
+            calls.append(argv)
+            # Report a removed container name so the CLI logs it.
+            return _proc(stdout=argv[-1])
+
+        with patch(_RUN, side_effect=fake):
+            self.assertEqual(0, rotate_ca.main([]))
+
+        # Persisted CA is gone → next start remints it.
+        self.assertEqual([], list(ca_dir.glob("mitmproxy-ca*")))
+        # Both the infra container and the standalone gateway are force-removed
+        # so no mitmproxy keeps serving the old CA from memory.
+        removed = {c[-1] for c in calls if c[:3] == ["docker", "rm", "--force"]}
+        self.assertEqual({INFRA_NAME, GATEWAY_NAME}, removed)
+
+    def test_succeeds_with_no_persisted_ca(self) -> None:
+        with patch(_RUN, return_value=_proc()) as m:
+            self.assertEqual(0, rotate_ca.main([]))
+        # Still tears down any running gateway even when there was no CA on disk.
+        self.assertTrue(m.called)
+
+
+if __name__ == "__main__":
+    unittest.main()