Enable all available protocols by default with tcp-tls priority

By default, the agent now enables all available data plane protocols
starting with `tcp-tls,wg-quic`, removing the need to manually pass `--protocol`
to enable HTTPS-camouflage transport. The `--protocol` option remains available
to explicitly restrict or select specific protocols (or reorder their priority).

Furthermore, in `crates/tsunagi-tcp-tls`, if default port 443 is unavailable
(e.g., due to permission constraints or address in use), the transport now
attempts fallback port 8443, and if 8443 is also unavailable, gracefully falls
back to an ephemeral port rather than failing agent startup.

Key changes:
- In `crates/tsunagi-cli/src/main.rs`, update `UpArgs::protocols` default_value
  to `"tcp-tls,wg-quic"`.
- In `crates/tsunagi-cli/src/main.rs`, reorder `PROTOCOLS` registry with `tcp-tls`
  first, followed by `wg-quic`.
- In `crates/tsunagi-tcp-tls/src/transport.rs`, add multi-tier fallback
  (443 -> 8443 -> ephemeral) for unconstrained port bindings.

Validation on Linux:
- cargo fmt --all -- --check passed.
- cargo clippy --locked --workspace --all-targets -- -D warnings passed.
- cargo test --locked --workspace --all-targets passed (349 tests passed).
- cargo build --release passed.

crates/tsunagi-cli/src/main.rs

@@ -424,7 +424,7 @@ struct UpArgs {
         long = "protocol",
         value_name = "LIST",
         value_delimiter = ',',
-        default_value = "wg-quic",
+        default_value = "tcp-tls,wg-quic",
         help_heading = "Transport"
     )]
     protocols: Vec<String>,
@@ -1175,6 +1175,12 @@ struct ProtocolSpec {
 
 /// Every protocol this build has.
 const PROTOCOLS: &[ProtocolSpec] = &[
+    ProtocolSpec {
+        name: TCP_TLS_PROTOCOL,
+        version: TCP_TLS_VERSION,
+        summary: "Noise E2EE carried over TCP TLS 1.3 (port 443) disguised as HTTPS traffic",
+        options: TcpTlsCodec::OPTIONS,
+    },
     ProtocolSpec {
         name: tsunagi_wg_quic::WIREGUARD_PROTOCOL,
         version: tsunagi_wg_quic::ANNOUNCEMENT_VERSION,
@@ -1182,12 +1188,6 @@ const PROTOCOLS: &[ProtocolSpec] = &[
                   crosses NAT and survives where plain WireGuard is blocked",
         options: WireguardPlugin::OPTIONS,
     },
-    ProtocolSpec {
-        name: TCP_TLS_PROTOCOL,
-        version: TCP_TLS_VERSION,
-        summary: "Noise E2EE carried over TCP TLS 1.3 (port 443) disguised as HTTPS traffic",
-        options: TcpTlsCodec::OPTIONS,
-    },
 ];
 
 /// One `-o` setting, and the protocol it was aimed at.