Terminate TLS-routed HTTP/2 with ALPN

[kacy]

Summary

• negotiate ALPN in the TLS handshake and prefer h2 when offered
• route TLS traffic for HTTP-routed hosts through the local listener instead of only direct container backends
• propagate https into the routed request path for both HTTP/1.1 and HTTP/2, with docs updated to reflect the supported edge behavior

Validation

• YOQ_SKIP_SLOW_TESTS=1 zig build test
• 1747 passed; 26 skipped; 0 failed