fix(proxy): keep HTTPS remembered for unprivileged mode after the proxy stops

Closes #564.

Problem

A proxy started with --unprivileged --https comes back as plain HTTP on port 80 after it stops, whether through portless proxy stop or a SIGTERM. Two things combine:

• Every stop path resets proxy.tls but keeps proxy.unprivileged, so the next start remembers unprivileged mode without the HTTPS that came with it.
• resolveProxyConfig serves plain HTTP in unprivileged mode unless HTTPS is passed explicitly, and an auto-start passes nothing, so a remembered HTTPS choice was never consulted.

Fix

• The six places that reset the remembered proxy settings (the daemon's exit cleanup and five proxy stop branches) now call one helper, resetPersistedProxySettings. It keeps proxy.tls while proxy.unprivileged is set and resets everything else as before.
• resolveProxyConfig takes persistedHttps. When unprivileged mode is resumed from the marker rather than requested, the remembered HTTPS choice comes back with it. An explicit --unprivileged or PORTLESS_UNPRIVILEGED=1 without HTTPS still serves plain HTTP, so the no-prompt default is unchanged.

Outside unprivileged mode nothing changes. #563 keeps every remembered setting across an idle exit; this covers an explicit stop and a kill. The two touch the same cleanup block, so whichever lands second needs a small rebase. For pinning the mode per project, #458 lets portless.json set unprivileged and https.

Test plan

• cli.test.ts: "keeps HTTPS for unprivileged mode after proxy stop" and "after SIGTERM" start with --unprivileged --https, stop the proxy, check both markers remain, start again with no flags and assert the log has HTTPS listeners and no plain HTTP one. Both fail on main and pass with the fix. All 13 unprivileged tests pass.
• pnpm format:check, lint, type-check and build pass. pnpm test: 1212 passed. Failures that also occur on main on the same machine: certs.test.ts (#429, OpenSSL), the mcp.test.ts "rejects every flag" test (5 s timeout under full-suite load, passes alone) and killOrphanedProcessGroup "does not signal a group leader…" (failed once under load, passes 5 of 5 alone on both this branch and main).
• The steps from #564 on macOS, with a trusted CA, an isolated state directory and no TTY: