Onboarding: --listen override and auto-pick free port; live TLS demo verified

src/main.rs

@@ -18,6 +18,8 @@ struct Cli {
     config: PathBuf,
     #[arg(long)]
     onboarding: bool,
+    #[arg(long)]
+    listen: Option<String>,
     #[command(subcommand)]
     command: Option<Command>,
 }
@@ -204,7 +206,7 @@ async fn main() -> Result<()> {
     if cli.onboarding {
         let mut input = std::io::stdin().lock();
         let mut output = std::io::stdout().lock();
-        onboard::run(&mut input, &mut output, &cli.config).await?;
+        onboard::run(&mut input, &mut output, &cli.config, cli.listen.as_deref()).await?;
         return Ok(());
     }
     let Some(command) = cli.command else {