fix(proxy): port HTTPS-upstream TLS-wrap from deployed bridge; unify CONNECT establishment

- parseProxyConfig handles PAC 'HTTPS host:port' (tls.connect + CONNECT inside TLS) in
  both the CONNECT and plain-HTTP handlers — ports live fix d8b9db2 into the repo
- CONNECT: split tunnel establishment into establishDirect / sendConnectToProxy,
  removing the duplicate DIRECT 'connect' listener that raced onUpstreamData
- env-overridable PROFILE_FILE / REMOTES_FILE / PAC_DIR (test hermeticity)
- tests: +DIRECT echo exactly-once, +HTTPS upstream via local PAC dir + self-signed
  TLS stub (no internet needed); 8/8 pass

scripts/proxy/fixtures/tls-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDCTCCAfGgAwIBAgIULTRbxVlHLzeuSHof5JIVRemCyeowDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJMTI3LjAuMC4xMB4XDTI2MDkyMzEyNDY0M1oXDTM2MDky
+MDEyNDY0M1owFDESMBAGA1UEAwwJMTI3LjAuMC4xMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAvYG9Gjhs/Z4HnVpQ9jmG7Yzy7v+kkmeRtlp6Ky2/pyN5
+XMum1Wtoj5oMp1IInBONOtwwt5pi837zIBlOC4cmBRUPnkBSIyYWMzlcOYTpshZ0
+di2wsgUGQWe4+PaUpoD+EoULnxLq8wt8QU9+wNQMQnfTMnhLrQX8Z3yegxrjoRcJ
+2G1lurouYuO+qkhvCVuMKTxa1svhpjlZ9ZHtoGsGulEnAN+4Rg9D85i9cYkL7lIv
+71RwhMSBUTTZBIx/O5aGOgropWoqKD8rOBN7nc2o1dh32gECO4VSpB7U3KjOxR2S
+u/dJBEaaCXsxjkblkDF9f7N6W8L+hEJ5X7URrUO+dwIDAQABo1MwUTAdBgNVHQ4E
+FgQU0fYOKTUiYxyREdlmUSpi6PyrIFYwHwYDVR0jBBgwFoAU0fYOKTUiYxyREdlm
+USpi6PyrIFYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEADFkY
+pcK5crh9LTgcGEguXRPwsESjE+VTOUBRADRtPd/v55RqyfOFFhqNpZXh8TNYzWaW
+d5Km7Ne6Bcj4rlURzuRVevQZPqce3LsiJYjxX9839db5e0MiflMLmcs3V0pTlKhb
+fzrG+kR5OBIvcOLI/xoXMRA/Iakb3swAkVFhMBYykJpqGwPvLs0YfUwKwkKDjVBy
+jy4+xvMZqz0T3yWRDfHA8fCrIdwC9u7+E4QtbahOYPEPuh5vSrJ0/kC264+QJGmQ
+e4hw/kh9TDF9G4NoI5CXc5jXTFdU2cuxfjqQddkgvSLeMs+pTCVE7MdwMnWezIwk
+8/de9gbsW5mCXZ73hQ==
+-----END CERTIFICATE-----