fix: keep relay in sync with active environment

[wakaka6]

Summary

• stop the shared relay when a newly created environment becomes active
• stop the relay when the active environment proxy changes or is removed
• discard a running relay whose recorded proxy does not match the active environment before TUN verification
• add regression coverage for relay lifecycle and proxy matching

Why

Relay state is global while proxy configuration is per environment. Creating an environment or changing the active proxy could leave a relay connected to the previous upstream. The health check could then probe that stale relay and attribute its failure to the current proxy.

Verification

• bash scripts/test-relay-env-sync.sh
• bash scripts/test-socks5h-probes.sh
• ShellCheck at warning severity
• Bash and JavaScript syntax checks
• generated cac build consistency check
• gitleaks scan