fix: enforce ECH requirements for HTTP/3

[ryanfowler]

Summary

• reject explicit --ech on requests that select HTTP/3 because QUIC cannot expose ECH acceptance
• force automatic HTTP/3 discovery and cache candidates onto the TCP TLS path when ECH hard-fail is enabled
• add unit and integration coverage and document the protocol restriction

Checks

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins
• cargo test --locked --all-features --test cli --test formatting --test grpc --test har --test http --test install --test network --test terminal --test update --test websocket -- --test-threads=2