feat: add redis-compatible tls support

[kacy]

summary

• adds redis-compatible TLS support using tokio-rustls
• TLS runs on a separate port (--tls-port) alongside plain TCP
• supports optional client certificate verification (mTLS) via --tls-ca-cert-file and --tls-auth-clients
• both TCP and TLS connections share the same engine, connection limits, and graceful shutdown

test plan

• all existing tests pass (283 tests)
• manual testing with self-signed certs:

  # generate certs
  openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
  
  # start server
  ./target/release/ember-server --tls-port 6380 --tls-cert-file cert.pem --tls-key-file key.pem
  
  # test plain TCP still works
  redis-cli -p 6379 PING
  
  # test TLS
  redis-cli -p 6380 --tls --insecure PING
  redis-cli -p 6380 --tls --insecure SET foo bar
  redis-cli -p 6380 --tls --insecure GET foo

design considerations

• separate port model: matches redis behavior. simpler than protocol detection on a single port
• generic handlers: handle() accepts any AsyncRead + AsyncWrite + Unpin, enabling code reuse between TCP and TLS
• shared resources: both listeners use the same semaphore, ServerContext, pubsub manager, etc.
• handshake in task: TLS handshake happens in the spawned task after TCP accept, avoiding blocking the accept loop
• aws-lc-rs by default: rustls 0.23 uses aws-lc-rs crypto provider (requires C compiler)