fix(cli): gateway status probe with TLS when bind=lan

- Use wss:// scheme when TLS is enabled (specifically for bind=lan)
- Load TLS runtime to get certificate fingerprint
- Pass fingerprint to probeGatewayStatus for self-signed cert trust

src/cli/daemon-cli/probe.ts

@@ -6,6 +6,7 @@ export async function probeGatewayStatus(opts: {
   url: string;
   token?: string;
   password?: string;
+  tlsFingerprint?: string;
   timeoutMs: number;
   json?: boolean;
   configPath?: string;
@@ -22,6 +23,7 @@ export async function probeGatewayStatus(opts: {
           url: opts.url,
           token: opts.token,
           password: opts.password,
+          tlsFingerprint: opts.tlsFingerprint,
           method: "status",
           timeoutMs: opts.timeoutMs,
           clientName: GATEWAY_CLIENT_NAMES.CLI,