Close the listener when TLS server startup fails

[zhechen-cs]

start_wsgi_server() binds its listening socket before loading the TLS configuration. If certificate loading or socket wrapping raises, the server is never returned to the caller and the listener stays open while the exception traceback is retained. Retrying startup on the same port then fails with an address-in-use error.

Close the server before re-raising TLS setup errors. The regression tests use real listening sockets and cover missing server certificates, missing client CA files, and a TLS context that cannot wrap a server socket. They retain the traceback and verify that the socket is closed and its port can be rebound. Existing successful HTTP, HTTPS and mutual TLS tests still pass.

Validation: all three new cases fail on the unmodified base; after the fix, 431 tests pass and 14 are skipped. The configured flake8, isort and mypy checks pass. Local HTTP tests used NO_PROXY=localhost,127.0.0.1,::1 to bypass the local proxy.

@csmarchbanks