feat(native-proxy): OS proxy configuration (Windows + macOS + Linux)

[kdroidFilter]

What

New native-proxy module — the proxy counterpart to native-ssl: it exposes the
OS proxy configuration to JVM desktop apps on Windows, macOS and Linux.

The implementation follows Chromium's proxy stack so the effective proxy matches
what Edge/Chrome/Safari resolve, including machine-wide and managed settings.

Platform	Chromium equivalent	Native surface
Windows	ProxyConfigServiceWin + ProxyResolverWinHttp	WinHTTP + Internet Settings registry watchers
macOS	ProxyConfigServiceMac + ProxyResolverApple	SCDynamicStore + CFNetworkExecuteProxyAutoConfigurationURL
Linux	ProxyConfigServiceLinux	GSettings (org.gnome.system.proxy) → KDE kioslaverc → env vars

Piece	Chromium equivalent
SystemProxySettings (autoDetect / pacUrl / rules / bypass)	net::ProxyConfig
ProxyRules — single list vs per-scheme (http=…;https=…;socks=…), socks= defaults to SOCKS4 and serves unlisted schemes	ProxyConfig::ProxyRules::ParseFromString
ProxyBypassRules / BypassRule — glob hostname patterns, leading . rewritten to *., :port and scheme:// restrictions, CIDR blocks, <local>, <-loopback>, implicit localhost + link-local bypass	net::ProxyBypassRules
PAC (Windows): explicit script URL wins over WPAD (DHCP + DNS_A); fAutoLogonIfChallenged=FALSE first, retried TRUE only on ERROR_WINHTTP_LOGIN_FAILURE	ProxyResolverWinHttp
PAC (macOS): CFNetworkExecuteProxyAutoConfigurationURL on a private CFRunLoop mode (10 s timeout)	ProxyResolverApple
Change detection (Windows): RegNotifyChangeKeyValue on the 6 HKCU/HKLM Internet Settings + Policies + Connections keys, 2 s coalescing delay	ProxyConfigServiceWin
Change detection (macOS): SCDynamicStore proxy-key notifications, 2 s coalescing delay	ProxyConfigServiceMac
Change detection (Linux): polls the desktop/env configuration (GSettings D-Bus signals need a process-default GMainContext the JVM does not drive)	—

Native bridges

• Windows — nucleus_proxy.dll (x64 + ARM64), /NODEFAULTLIB CRT-free like native-ssl
  • nativeGetProxyConfig() → WinHttpGetIEProxyConfigForCurrentUser as 4 strings
  • nativeResolveProxyForUrl(url, pacUrl) → proxy list, "" for DIRECT, null on failure
  • nativeWaitForConfigChange / nativeWakeWatcher — blocking registry wait (no native callbacks, no polling)
• macOS — libnucleus_proxy.dylib (arm64 + x86_64)
  • nativeGetProxyConfig() → SCDynamicStoreCopyProxies as the same 4-string layout
  • nativeResolveProxyForUrl(url, pacUrl) → PAC via CFNetwork
  • nativeWaitForConfigChange / nativeWakeWatcher — SCDynamicStore on the current CFRunLoop
• Linux — libnucleus_proxy.so (x64 + aarch64), GIO resolved with dlopen (no hard libgio link)
  • GNOME-like GSettings path in native; KDE kioslaverc + http_proxy/no_proxy/… env fallback in Kotlin

The 4-string config array is shared across platforms so Kotlin feeds the same
ProxyRules / ProxyBypassRules parsers:

Index	Content
0	WinInet-style proxy string (http=…;https=…;socks=…)
1	Bypass list (;-joined; macOS appends <local> when ExcludeSimpleHostnames is set)
2	PAC script URL
3	WPAD flag ("1" / "0")

API

NativeProxy.install()                        // OS proxy as the JVM-wide ProxySelector
NativeProxy.proxiesFor(URI("https://intranet.corp"))
NativeProxy.addChangeListener { settings -> /* … */ }

install() keeps the previous default selector as a fallback, so the JDK
http.proxyHost properties keep working for URIs the OS has no opinion on.
Resolution order per URL: bypass list → PAC script → static rules (the
latter also being the fallback when the script cannot be evaluated). PAC
results are cached per origin and dropped on every configuration change.

Platform caveats

• Linux does not evaluate PAC/WPAD scripts (no WinHTTP/CFNetwork equivalent
  without embedding a JS engine) — only static rules and bypass lists.
• macOS pure WPAD without an explicit PAC URL is reported via autoDetect
  but not evaluated: when DHCP WPAD succeeds, Apple embeds the discovered PAC
  URL into the system settings, so an empty pacUrl almost always means there
  is nothing to run.

Verification

• :native-proxy:check green (detekt + ktlint + unit tests for the parsers,
  bypass matcher, env/KDE helpers, and per-platform load/read smoke tests)
• Windows — both DLLs build with MSVC (x64 + ARM64); live box: config read,
  localhost → DIRECT, registry write detected by the watcher, nativeWakeWatcher
  releases the parked thread immediately
• macOS — both dylibs build with clang; live check against scutil --proxy:
  HTTP/HTTPS/SOCKS hosts match, loopback stays DIRECT, install() wires the
  JVM selector
• Linux — .so builds on x64/aarch64; GSettings/KDE/env unit tests +
  optional E2E via NUCLEUS_PROXY_E2E=true

Follow-ups (not in this PR)

• Wiring into native-http / native-http-okhttp / native-http-ktor
• Demo app integration
• Linux PAC evaluation (would need a JS engine or an external helper)