feat(proxy): connection proxy support (HTTP CONNECT / SOCKS5, per-host)

[thangnm93]

Summary

Adds a per-host outbound proxy so SSH hosts on restricted networks can be reached through an HTTP CONNECT or SOCKS5 proxy. Applies to local-originated TCP dials (direct target + first bastion) and complements the existing jump chain. Closes #74.

Changes

• proxy_settings.dart — ProxyType enum (none/http/socks5) + ProxySettings value.
• proxy_handshake.dart — pure ByteReader + httpConnectHandshake (Basic auth, 200 check) + socks5Handshake (RFC 1929 auth, ATYP-domain remote DNS, reply-code messages) + ProxyException. Over-read bytes are preserved so the SSH banner isn't lost.
• connection_proxy.dart — ConnectionProxy.connect dials the proxy, runs the handshake, returns a _ProxiedSocket (an SSHSocket) that re-emits the leftover ahead of live data; destroys the socket on failure; optional whole-operation timeout.
• Host — proxyType/proxyHost/proxyPort/proxyUsername (sync round-trip, unknown type → none). Proxy password in secure storage (proxy_pw_<id>), never in JSON.
• SshService — loadProxyPassword/saveProxyPassword, injectable directDialer/proxyDialer, and localDial wired into the three local-originated dial sites (connect, dialHop hop0, testConnection). No dartssh2 fork change.
• Host panel — PROXY section (SSH-only): type dropdown + host/port/username/password, persisted on save.

Type of change

• feat — new feature

How was this tested?

• cd app && flutter analyze — no new warnings (6 touched files clean)
• cd app && flutter test — 18 new tests (settings 2, HTTP 3, SOCKS5 4, proxy socket 1, host 4, ssh_service 2, panel 2) + full host-panel + test/models/ (189) regression pass
• Manually verified on: pending (needs a live proxy — e.g. ssh -D 1080 for SOCKS5, tinyproxy for HTTP CONNECT)

Security notes

• SOCKS5 sends the target as a domain (remote DNS); proxy password kept in secure storage only.
• Handshake failures (HTTP non-200, SOCKS reply != 0, auth failure, early close) raise ProxyException with a clear message; the proxy socket is destroyed on any failure.

Checklist

• PR title follows Conventional Commits
• Code and comments are written in English
• New/changed behavior is covered by tests
• No secrets, credentials, or personal data in the diff