Function client_cert_node_id 

pub fn client_cert_node_id(cert_der: &[u8]) -> Option<String>

Read a relay node-id from an OUTER client certificate’s subject Common Name.

Used only by the optional outer-mTLS relay variant: when an operator issues outer client certs whose CN is the target node-id, the relay binds which node a client may reach to its certificate (additive admission), falling back to the Connect frame’s node-id when the cert carries none. Returns None for an unparseable cert or an empty CN. This never touches the inner mTLS.