Support CAP_NET_BIND_SERVICE raising for privileged TCP TLS ports

When file capabilities are granted with `sudo setcap ...+p`, capabilities
are placed into the thread's permitted set rather than its effective set.
While TUN interface provisioning in `tsunagi` properly acquired and dropped
CAP_NET_ADMIN using `caps::raise`, `tsunagi-tcp-tls` attempted to bind port 443
directly without activating CAP_NET_BIND_SERVICE, resulting in EACCES
(os error 13 Permission denied).

Fixes and improvements:
- Add `caps` dependency to `tsunagi-tcp-tls` on Linux.
- Implement `NetBindServiceGuard` to temporarily raise CAP_NET_BIND_SERVICE
  into the effective set for the synchronous `TcpListener::bind` invocation
  and immediately drop it afterwards.
- Clarify diagnostic warnings to distinguish between default port 443 fallback
  and explicitly requested port failure.
- Update all privilege diagnostics and error hints across the codebase
  to uniformly recommend granting both capabilities:
  `sudo setcap cap_net_admin,cap_net_bind_service+p <path>`.

Validation on Linux:
- `cargo fmt --all -- --check` passed.
- `cargo clippy --locked --workspace --all-targets -- -D warnings` passed.
- `cargo test --locked --workspace --all-targets` passed (all workspace unit,
  integration, and protocol tests passed).

crates/tsunagi-cli/src/main.rs

@@ -2890,8 +2890,12 @@ fn host_section() -> report::Section {
                 // explanation belongs in the runtime error, not in a column
                 // the eye is meant to scan.
                 host.push(
-                    Row::new(Health::Degraded, "privileges", "CAP_NET_ADMIN not held")
-                        .with_note(format!("sudo setcap cap_net_admin+p {}", program_path())),
+                    Row::new(Health::Degraded, "privileges", "CAP_NET_ADMIN not held").with_note(
+                        format!(
+                            "sudo setcap cap_net_admin,cap_net_bind_service+p {}",
+                            program_path()
+                        ),
+                    ),
                 );
                 host.push(Row::new(
                     Health::Degraded,