fix: auto-wrap TLS for port 443 in _send_remote

Port 443 → ssl.create_default_context().wrap_socket() before the
challenge handshake so Traefik TCP routers with TLS termination work.
Other ports stay plain TCP.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

browser_cli/client.py

@@ -242,9 +242,21 @@ def _send_remote(endpoint: str, msg: dict, private_key=None) -> bytes | None:
     host, _, port_str = endpoint.rpartition(":")
     if not host or not port_str:
         raise BrowserNotConnected(f"Invalid remote endpoint '{endpoint}': expected host:port")
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.settimeout(30)
-        sock.connect((host, int(port_str)))
+    port = int(port_str)
+    raw_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    raw_sock.settimeout(30)
+    try:
+        raw_sock.connect((host, port))
+        if port == 443:
+            import ssl
+            ctx = ssl.create_default_context()
+            sock = ctx.wrap_socket(raw_sock, server_hostname=host)
+        else:
+            sock = raw_sock
+    except Exception:
+        raw_sock.close()
+        raise
+    with sock:
 
         # receive challenge
         challenge_raw = _recv_all(sock)