feat: add greywall check and greywall setup commands

Add diagnostic and setup commands so users can verify their environment
and install greyproxy without leaving greywall:

- `greywall check`: shows version, platform deps, security features,
  and greyproxy installation/running status (absorbs old --version output)
- `greywall setup`: downloads greyproxy from GitHub releases and shells
  out to `greyproxy install`, or auto-starts if already installed
- `--version` simplified to single-line output for scripting

New `internal/proxy/` package handles greyproxy detection (LookPath +
/api/health endpoint), GitHub release fetching, tar.gz extraction,
and service lifecycle management.

internal/proxy/start.go

@@ -0,0 +1,30 @@
+package proxy
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+// Start runs "greyproxy service start" to start the greyproxy service.
+func Start(output io.Writer) error {
+	if output == nil {
+		output = os.Stderr
+	}
+
+	path, found := checkInstalled()
+	if !found {
+		return fmt.Errorf("greyproxy not found on PATH")
+	}
+
+	_, _ = fmt.Fprintf(output, "Starting greyproxy service...\n")
+	cmd := exec.Command(path, "service", "start") //nolint:gosec // path comes from exec.LookPath
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("failed to start greyproxy service: %w", err)
+	}
+
+	return nil
+}