[log] Add debug logging to LoadGatewayTLS (#5971)

## Summary

Enhances `internal/server/gateway_tls.go` with additional debug logging
calls in `LoadGatewayTLS` to improve observability during TLS
configuration setup.

## Changes

File modified: `internal/server/gateway_tls.go`

Log calls added/improved:
1. (improved) Log leaf certificate count after key pair loaded
2. (new) Log CA certificate pool built successfully (mTLS path)
3. (new) Log one-way TLS configured (no client certs required)
4. (new) Log final TLS configuration ready with mtls status

## Validation

- `go build ./...` passes
- `go vet ./...` passes

## Logger

Reuses existing `var logGatewayTLS = logger.New("server:tls")` — no new
logger declaration needed.




> Generated by [Go Logger
Enhancement](https://github.com/github/gh-aw-mcpg/actions/runs/26066891283/agentic_workflow)
· ● 9.9M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+go-logger%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Go Logger Enhancement, engine: copilot,
version: 1.0.40, model: claude-sonnet-4.6, id: 26066891283, workflow_id:
go-logger, run:
https://github.com/github/gh-aw-mcpg/actions/runs/26066891283 -->

<!-- gh-aw-workflow-id: go-logger -->

Author: lpcox

internal/server/gateway_tls.go

@@ -31,7 +31,7 @@ func LoadGatewayTLS(certPath, keyPath, caPath string) (*tls.Config, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to load server TLS certificate/key: %w", err)
 	}
-	logGatewayTLS.Print("server TLS key pair loaded")
+	logGatewayTLS.Printf("server TLS key pair loaded: certChainLen=%d", len(serverCert.Certificate))
 
 	cfg := &tls.Config{
 		Certificates: []tls.Certificate{serverCert},
@@ -48,12 +48,16 @@ func LoadGatewayTLS(certPath, keyPath, caPath string) (*tls.Config, error) {
 		if !caPool.AppendCertsFromPEM(caPEM) {
 			return nil, fmt.Errorf("failed to parse CA certificate from %s", caPath)
 		}
+		logGatewayTLS.Printf("CA certificate pool built: ca=%s", caPath)
 
 		// Require and verify client certificates signed by the provided CA.
 		cfg.ClientCAs = caPool
 		cfg.ClientAuth = tls.RequireAndVerifyClientCert
 		logGatewayTLS.Printf("mTLS enabled: client certificates required, CA=%s", caPath)
+	} else {
+		logGatewayTLS.Print("one-way TLS configured: client certificates not required")
 	}
 
+	logGatewayTLS.Printf("gateway TLS configuration ready: minVersion=%s, mtls=%v", tls.VersionName(cfg.MinVersion), caPath != "")
 	return cfg, nil
 }