Serve --tld beside .local in LAN mode

1. LAN mode served .local names only. --tld was dropped with a warning, and the proxy then refused a certificate for, and routed nothing to, a name under any other TLD. Turning on LAN mode to test on a phone took every .localhost URL on the machine down.
2. That matters for AI coding agents as well as for #346's OAuth case. Some agents treat .localhost and .test as the only safe local hosts and will sign in with a test account, enter a test key, or submit a form only there. A .local name doesn't qualify, since other devices on the network can reach it, so while the proxy is in LAN mode an agent can't use the app it just started.
3. With --lan, the proxy now serves the TLDs given with --tld in their order, adding .local last when it's missing: --lan --tld com serves .com, .local, and --lan --tld local --tld localhost keeps .local first. --lan alone still serves .local only. The same holds for proxy start, its background start, service install, and the TLD collision check before run.
4. mDNS announces only the .local names. Names under the other TLDs resolve on this machine only, as they do outside LAN mode.
5. An app's PORTLESS_TLD may now name any TLD the running proxy serves, and that TLD becomes its PORTLESS_URL's. Before, any PORTLESS_TLD that wasn't exactly the proxy's list stopped run with a config mismatch. So a person can use myapp.local from a phone while an agent on the same machine runs with PORTLESS_TLD=localhost and gets myapp.localhost. The LAN -> line names the .local URL.
6. README, the skill, the docs pages, --help, service --help and the MCP help say so.
7. Closes #346.

Tested

• New tests in cli-utils.test.ts, service.test.ts and cli.test.ts. The two privileged proxy tests in cli.test.ts fail on my machine only because a proxy already holds port 443, as they do on main.
• On a throwaway proxy (its own state directory, port 9443, --lan --ip 127.0.0.1 --tld localhost), one app with no PORTLESS_TLD and one with PORTLESS_TLD=local each answered over HTTPS on both its .localhost and .local names, with the PORTLESS_URL it asked for.
• An earlier version of this change, applied to 0.17.0's build as a patch, runs my LAN proxy now. mDNS announcing only .local names hasn't been checked from another device.