Pass mode, backend-tls, and tls cert/key through route add

The --mode flag was defined but never wired through to the RPC.
Add tls_cert and tls_key fields to AddProxyRouteRequest so L7
routes can be created via mcp route add.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

proto/mcp/v1/mcp.proto

@@ -362,6 +362,8 @@ message AddProxyRouteRequest {
   string backend = 3;
   string mode = 4;           // "l4" or "l7"
   bool backend_tls = 5;
+  string tls_cert = 6;       // path to TLS cert (required for l7)
+  string tls_key = 7;        // path to TLS key (required for l7)
 }
 
 message AddProxyRouteResponse {}