feat: support standard outbound proxy environment

[yeads]

Summary

Add standard outbound proxy support across Codex Pooler's HTTP, HTTPS, and WebSocket clients.

Deployments can now configure egress using the conventional lowercase environment variables:

• http_proxy for HTTP and WS targets
• https_proxy for HTTPS and WSS targets
• no_proxy for destinations that should connect directly

The uppercase HTTP_PROXY, HTTPS_PROXY, and NO_PROXY variants are also supported as fallbacks, with lowercase values taking precedence.

Changes

• Parse proxy configuration once at boot and reject unsupported or malformed proxy URLs without exposing embedded credentials in errors.
• Select http_proxy or https_proxy according to each request's target scheme.
• Apply the selected proxy consistently to gateway dispatch, authentication, usage probes, saved-reset requests, catalog synchronization, pricing imports, status feeds, alert webhooks, file creation and upload traffic.
• Route upstream WebSocket connections through the same configuration, using HTTP forwarding for WS and CONNECT tunneling for WSS.
• Preserve existing connection, pool, receive, and idle timeout behavior when proxy options are added.
• Support HTTP Basic proxy authentication through percent-encoded credentials in the proxy URL.
• Honor no_proxy entries for exact hosts, domain suffixes, IPv4 and IPv6 addresses, CIDR ranges, optional ports, and the * wildcard.
• Update Compose environment generation, example environment files, English and Chinese README content, and the documentation site.

Configuration

http_proxy=http://proxy.example.com:3128
https_proxy=http://user:password@proxy.example.com:3128
no_proxy=localhost,127.0.0.1,.example.internal,10.0.0.0/8

Only http:// proxy endpoints are accepted. HTTPS and WSS targets use an HTTP CONNECT tunnel through the configured https_proxy.

Leaving a lowercase variable empty explicitly disables its uppercase fallback.

Verification

• Added unit coverage for proxy URL parsing, authentication headers, scheme selection, connection-option merging, and no_proxy matching.
• Added an integration test proving that a Req HTTP request reaches a configured proxy instead of resolving the destination directly.
• Added runtime configuration coverage for lowercase precedence, credential decoding, and sanitized invalid-configuration errors.
• Updated an existing gateway transport test to exercise URL-aware proxy selection.
• Confirmed git diff --check passes.
• Confirmed the self-host environment generator passes sh -n and emits the three proxy variables correctly.

The full ExUnit suite was not run in the implementation environment because Elixir/Mix was unavailable and the Docker daemon was inaccessible.