fix(tlsbridge): reject unrecognized tls_bridge.ca_source in config validation

An unknown ca_source (e.g. typo'd 'vault') previously fell through to the
ephemeral CA silently; fail fast so a misconfigured file-CA deployment is a
loud startup error rather than silent ephemeral mode.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -60,6 +60,9 @@ func (b *TLSBridgeConfig) Validate() error {
 	if b.Scope != "" && b.Scope != "external" && b.Scope != "all" {
 		return fmt.Errorf("tls_bridge.scope must be 'external' or 'all', got %q", b.Scope)
 	}
+	if b.CASource != "" && b.CASource != "file" && b.CASource != "ephemeral" {
+		return fmt.Errorf("tls_bridge.ca_source must be 'file' or 'ephemeral', got %q", b.CASource)
+	}
 	if b.CASource == "file" && (b.CACertPath == "" || b.CAKeyPath == "") {
 		return fmt.Errorf("tls_bridge.ca_source=file requires ca_cert_path and ca_key_path")
 	}