Reject TLS key-only config from merged sources

[ryanfowler]

Summary

• Reject --key without --cert once the effective request URL is TLS, so config and --from-curl values can no longer be silently ignored.
• Apply the same guard to HTTPS requests, WSS handshakes, and TLS inspection paths.
• Document the TLS client-auth requirement in the CLI, config, and authentication docs.

Testing

• Added regression coverage for HTTPS config key-only failure and HTTPS --from-curl key-only failure.
• Existing HTTP key-only compatibility tests still pass.
• Verified with unit tests and the serial integration suite.