mode

How CoSec runs in this service, as defaults its own cosec.* keys override (CoSecModeEnvironmentPostProcessor): gateway, behind a CoSec gateway (cosec.pipeline.mode=gateway: the caller read from the CoSec-Identity the gateway verified, with its app and space, and no token verified here); disabled, CoSec off (cosec.enabled=false). Unset, CoSec's own defaults: CoSec decides the requests itself, the Manifest's routes its route map.