CLI --print-handoff builds an http:// deep link when the web UI is served over TLS #2770

Found by Copilot's review of the v2.12.0 milestone-merge PR #2769 (comment). It is a gap in #2446 / PR #2732.

Problem

With INSPECTOR_TLS_KEY_PATH and INSPECTOR_TLS_CERT_PATH both set, the web listener serves https only, since a plain-http request gets an empty reply. #2732 made the web banner, defaultAllowedOrigins and portInUseMessage select the scheme from the resolved TLS pair. The one-shot CLI's OAuth hand-off, however, still hardcodes http:

// clients/cli/src/cli.ts, buildHandoff()
deepLink: `http://${linkHost}:${clientPort}/?${params.toString()}`,

So mcp-inspector --cli … --print-handoff, run for an Inspector launched with TLS, prints a deep link that cannot load.

Expected

buildHandoff() picks https when the same TLS environment the web server reads is configured, using the same "both set, blank counts as unset" rule as clients/web/server/tls.ts. It stays http otherwise. The fix needs a regression test for the TLS-enabled case, and one showing that a half pair stays http, or whatever matches the web server's refusal to start in that case.

This is scoped to the deep link's scheme. The port-forward command and the sandbox/app-origin ports are unchanged, because those listeners stay plain http under TLS by design (docs/tls.md).