fix: add udp/ prefix to Caddy L4 UDP listen addresses and fix E2E test selectors

- Fix Caddy L4 config to use "udp/:PORT" listen syntax for UDP proxy hosts
  (previously used bare ":PORT" which Caddy treated as TCP)
- Fix TCP unused port test to check data echo instead of connection refusal
  (Docker port mapping accepts TCP handshake even without a Caddy listener)
- Fix mTLS import test to wait for sheet close and scope cert name to table
- Fix CA certificate generate test to scope name assertion to table
- Remaining L4 routing test failures are infrastructure issues with Docker
  port forwarding and Caddy L4 UDP listener startup timing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/caddy.ts

@@ -1495,8 +1495,13 @@ async function buildL4Servers(): Promise<Record<string, unknown> | null> {
       routes.push(route);
     }
 
+    // Determine protocol from the hosts on this listen address.
+    // All hosts sharing a listen address must use the same protocol.
+    const protocol = hosts[0].protocol as string;
+    const listenValue = protocol === "udp" ? `udp/${listenAddr}` : listenAddr;
+
     servers[`l4_server_${serverIdx++}`] = {
-      listen: [listenAddr],
+      listen: [listenValue],
       routes,
     };
   }