fix: include user/password in HTTP_PROXY URL for macOS daemon mode

The HTTP CONNECT proxy URL was missing credentials from the SOCKS5
proxy URL. Now extracts userinfo from the configured proxy URL so
apps authenticating via HTTP_PROXY get the same credentials.

internal/sandbox/macos.go

@@ -767,11 +767,18 @@ func WrapCommandMacOS(cfg *config.Config, command string, exposedPorts []int, da
 			// HTTP CONNECT proxy (port 42051) for apps that only understand
 			// HTTP proxies (opencode, Node.js tools, etc.). The CONNECT
 			// proxy resolves DNS server-side.
-			proxyHost := "localhost"
-			if u, err := url.Parse(socks5hURL); err == nil && u.Hostname() != "" {
-				proxyHost = u.Hostname()
+			httpProxyURL := "http://localhost:42051"
+			if u, err := url.Parse(socks5hURL); err == nil {
+				userinfo := ""
+				if u.User != nil {
+					userinfo = u.User.String() + "@"
+				}
+				host := u.Hostname()
+				if host == "" {
+					host = "localhost"
+				}
+				httpProxyURL = "http://" + userinfo + host + ":42051"
 			}
-			httpProxyURL := "http://" + proxyHost + ":42051"
 			sandboxEnvs = append(sandboxEnvs,
 				"ALL_PROXY="+socks5hURL, "all_proxy="+socks5hURL,
 				"HTTP_PROXY="+httpProxyURL, "http_proxy="+httpProxyURL,