feat: feature-gate CLI args by server/client features

- CLI now shows only relevant options: --server and --server-* args
  hidden when built without 'server' feature; --client-* args hidden
  without 'client' feature. Run --help only displays applicable options.
- Removed verbose 'conflicts_with_all' from all mode args — clap's
  implicit group("mode") already enforces mutual exclusivity.
- 'server' feature now includes TLS/HTTPS by default (axum-server);
  'tls' feature removed. rustls already available via client/ureq.
- Gated KeepModes::Server, server mode detection, and server-password
  validation in main.rs.
- Gated server arg reads in config.rs.
- Removed redundant #[cfg(feature = "tls")] guards from server/mod.rs.
- Gated resolve_item_id/resolve_item_ids helpers in common.rs.
- All 4 feature combinations (server+client, server-only, client-only,
  neither) compile and pass tests.

Cargo.toml

@@ -96,8 +96,8 @@ default = [
         "zstd"
 ]
 
-# Server feature (includes axum and related dependencies)
-server = ["dep:axum", "dep:tower", "dep:tower-http", "dep:utoipa", "dep:jsonwebtoken"]
+# Server feature (includes axum and TLS/HTTPS via axum-server; rustls already available via client/ureq)
+server = ["dep:axum", "dep:tower", "dep:tower-http", "dep:utoipa", "dep:jsonwebtoken", "dep:axum-server"]
 
 # Compression features
 gzip = ["flate2"]
@@ -121,9 +121,6 @@ swagger = ["dep:utoipa-swagger-ui"]
 # Client feature (HTTP client for remote server)
 client = ["dep:ureq", "dep:os_pipe"]
 
-# TLS feature (HTTPS server support)
-tls = ["dep:axum-server"]
-
 # Token counting feature (LLM token support via tiktoken)
 tokens = ["dep:tiktoken-rs"]