feat: support CA-free proxying and toggle TLS interception in the TUI

[sadgoodman]

What this changes

-tunnel now starts without loading or creating a CA, forwards HTTPS unchanged, and shows setup instructions that require no certificate installation. The Cert view adds m and TLS off / TLS on buttons to switch interception for new connections without restarting; existing sessions retain their mode. Enabling interception initializes the CA when needed without installing it into the trust store.

CONNECT now supports server-first protocols and returns 502 if the upstream connection fails. The source version is bumped to 0.1.3 for the next release, with English and Russian documentation updated.

Why

Allow ordinary HTTPS proxying without certificate setup and make switching between pass-through and interception available directly in the terminal UI.

How it was tested

• go test ./... -count=1 -race and go vet ./... passed locally on macOS.
• Integration tests verify the original server certificate, opaque HTTPS contents, server-first and buffered CONNECT traffic, upstream failures, CA-free startup, and mode switching while connections remain open.
• TUI tests cover keyboard and mouse toggles, certificate initialization, and no automatic trust-store changes.
• Cross-compilation passed for Linux, macOS and Windows on amd64/arm64, plus FreeBSD on amd64.
• Built executable reports cli-proxy 0.1.3.

Checklist

• gofmt -l . reports nothing
• go vet ./... is clean
• go test ./... passes
• New behaviour is covered by a test
• No new dependency was added
• README.md / docs/guide.md updated for flags and keys