feat: add --http-proxy flag for configurable HTTP CONNECT proxy

Add network.httpProxyUrl config field and --http-proxy CLI flag
(default: http://localhost:42051) for apps that only understand
HTTP proxies (opencode, Node.js tools, etc.).

macOS daemon mode now sets:
- ALL_PROXY=socks5h:// for SOCKS5-aware apps (curl, git)
- HTTP_PROXY/HTTPS_PROXY=http:// for HTTP-proxy-aware apps

Credentials from the SOCKS5 proxy URL are automatically injected
into the HTTP proxy URL when not explicitly configured.

internal/daemon/tun.go

@@ -17,7 +17,7 @@ import (
 const (
 	tunIP            = "198.18.0.1"
 	dnsRelayIP       = "127.0.0.2"
-	dnsRelayPort     = "15353" // high port; pf rdr rewrites port 53 → this port
+	dnsRelayPort     = "15353"           // high port; pf rdr rewrites port 53 → this port
 	defaultDNSTarget = "127.0.0.1:42053" // proxy's DNS resolver (UDP), used when dnsAddr is not configured
 	pfAnchorName     = "co.greyhaven.greywall"