Pass mode, backend-tls, and tls cert/key through route add

The --mode flag was defined but never wired through to the RPC.
Add tls_cert and tls_key fields to AddProxyRouteRequest so L7
routes can be created via mcp route add.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/agent/proxy_rpc.go

@@ -69,6 +69,8 @@ func (a *Agent) AddProxyRoute(ctx context.Context, req *mcpv1.AddProxyRouteReque
 		Backend:    req.GetBackend(),
 		Mode:       req.GetMode(),
 		BackendTLS: req.GetBackendTls(),
+		TLSCert:    req.GetTlsCert(),
+		TLSKey:     req.GetTlsKey(),
 	}
 
 	if err := a.Proxy.AddRoute(ctx, req.GetListenerAddr(), route); err != nil {