feat(proxy): global and per-account outbound proxy support

[caigee-cmd]

Summary

Adds outbound proxy support across every account family: one global setting with a per-account override.

• Global setting — stored in app_secrets as proxy_url, bootstrapped from QODER_PROXY_URL, editable on the System page. Validated http(s)-only (proxy.ValidateHTTPOnly) because Qoder child workers inherit it. direct / none explicitly bypass.
• Per-account override — new SQLite migration 019_account_proxy.sql adds accounts.proxy_url. Override wins over global. Qoder account-level proxies are http(s)-only; WorkBuddy / Trae also accept socks5. Credentials are redacted in console responses, and redacted re-submits resolve back to the stored value (proxy.Preserve).
• Qoder workers — ExecStarter pushes the effective proxy as HTTP(S)_PROXY + QODER_PROXY_URL; worker/src/daemon.mjs installs an undici ProxyAgent (or plain Agent for direct/none) as the global dispatcher and overrides fetch. Worker pins undici 6.21.2; deploy/Dockerfile runs npm ci.
• WorkBuddy / Trae — in-process adapters select a Go transport from a per-client proxy.TransportCache (bounded LRU, 32 entries, evicts with CloseIdleConnections) so CONNECT tunnels are reused.
• Reload semantics — Manager.ReloadProxyURL restarts only enabled child-process accounts that inherit the global proxy; a failed reload stays pending so an identical PATCH retries. Editing an account proxy restarts that account.

New package

internal/proxy: Parse, ValidateHTTPOnly, Redact, Preserve, Effective, NewTransport/NewClient, and TransportCache.

Docs

README.md / README_EN.md / deploy/README.md document QODER_PROXY_URL. Console static assets rebuilt to match frontend/dist.

Testing

• go build ./..., go vet ./... clean.
• go test ./... green (new tests in internal/proxy, internal/accounts, internal/api, internal/providers/{trae,workbuddy}).

Not merging now — opening for review.

[caigee-cmd]

Heads-up for review: this branch is CONFLICTING against main.

• Only conflicting file: internal/providers/workbuddy/client_test.go.
• Underlying cause is semantic, not just textual. main (fix(workbuddy): expose deepseek-v4.1-flash via catalog alias #153) removed the WorkBuddy CLI-agent filter from Models() (so every non-disabled catalog model is exposed) and updated the test to expect 2 models. This branch instead re-adds the CLI-agent filter (and adds upstreamModelID() alias→native chat mapping), expecting 1 model.
• Note: at the branch's base (4f530a1) the workbuddy suite was already red — fix(workbuddy): expose deepseek-v4.1-flash via catalog alias #153 removed the filter but left the ...AcceptsGlobalCLIAgentNames... test expecting 1 model. The two sides fixed that inconsistency in opposite directions.

Resolution requires picking the WorkBuddy model-exposure direction (follow main, or keep this branch's CLI-agent filter). Left unresolved deliberately — not merging anything yet.