Add ts dev proxy: local MITM dev proxy for serving production hostnames from staging #824

Summary

Provide a local developer tool — ts dev proxy — that lets you open a
production publisher hostname in a real browser and have it served by a
dev/staging upstream, without touching production DNS, VCL, or certificates.

It's a TLS-terminating (MITM) forward proxy: for the configured host(s) it swaps
the TLS SNI to the upstream while the address bar keeps showing the
production hostname, so you can validate routing, cookies, Host-sensitive
logic, CMP/consent flows, and first-party context against a new Trusted Server
deployment before any DNS cutover.

Scope

• New ts CLI (crates/trusted-server-cli, native binary excluded from the
  wasm workspace): ts dev proxy + ts dev proxy ca install|uninstall|regenerate.
• Flags: --from/--to/--map, --rewrite-host, --resolve HOST:IP (curl-style
  DNS pin), --basic-auth/--basic-auth-file, --launch chrome|firefox|safari,
  --listen, --insecure, --allow-non-loopback.
• CONNECT MITM with a per-machine local CA (trust once); blind-tunnel unmatched
  hosts; 421/403 guards; loopback-only by default; PAC route; browser + CA
  orchestration. macOS-only (deps cfg-scoped).

Known follow-up (not in this issue)

Through the production Fastly adapter, --rewrite-host's X-Forwarded-Host: FROM signal is stripped as spoofable, so absolute first-party URLs anchor to
TO. The proper fix is a constrained, authenticated first-party-host override
in core/adapter (or relying on root-relative URLs) — tracked separately.

Implemented in #798.