fix(providers): support scoped proxies across all backends - #5992

Summary

Fixes NAN-212.

• Expose Advanced → Network proxy for every provider, including native backends, OAuth providers, custom providers, and transcription-only providers. OAuth settings use the advertised advanced fields rather than a separate frontend whitelist.
• Forward provider-scoped proxies to Anthropic-compatible services such as Kimi Coding, Azure OpenAI, Bedrock, and GitHub Copilot. Preserve SDK defaults when unset and give explicit proxies precedence over environment proxy settings.
• Cover provider model discovery, Copilot device login and token refresh, and transcription requests. Persist Copilot proxy settings without persisting OAuth credentials.
• Keep Bedrock bearer tokens session-local instead of changing the process environment. Include aiohttp in the Azure extra for its asynchronous credential transport.
• Document defaults, proxy precedence, and credential-helper limitations; add configuration, transport, persistence, and UI regressions.

Verification

• Channel/transcription regression suite: 254 passed. Adapter stubs accept proxy settings and verify both unset proxies and changed proxies after switching providers at call time.
• 1628 passed, 2 skipped across provider/config/CLI/settings/transcription Python suites:

  .venv\Scripts\python.exe -m pytest tests/providers tests/config tests/cli/test_commands.py tests/cli/test_copilot_proxy.py tests/webui/test_settings_api.py tests/webui/test_provider_proxy_settings.py tests/webui/test_transcription_ws.py --ignore=tests/providers/test_internal_streaming.py -q

• 65 WebUI tests passed in settings-providers.test.tsx and settings-models.test.tsx; production TypeScript/Vite build passed.
• Real localhost recording-proxy tests exercised public chat() calls for Anthropic, Azure, Bedrock, Copilot, and OpenAI-compatible backends. Requests reached the explicit proxy with an unusable environment proxy and NO_PROXY=*, using an invalid origin host and deterministic responses.
• Built WebUI with an isolated real gateway and Playwright: all 45 exposed provider rows advertised proxy. Kimi Coding, Azure OpenAI, Bedrock, AssemblyAI, and GitHub Copilot passed Advanced-field visibility, save, reload persistence, clear, and reload checks. Final browser console had no errors or warnings; the owned runtime was removed and ports released.
• Ruff, targeted ESLint, strict BasedPyright for modified Python modules, and git diff --check passed.

Validation limits

• tests/providers/test_internal_streaming.py is excluded because it imports unavailable agent.runner_helpers; the Python result is not a full-repository test run.
• Full-repository BasedPyright was not green in this environment because optional channel/integration dependencies are missing.
• Full frontend TypeScript checking reports existing test diagnostics. A same-dependency comparison using HEAD contents for both changed TypeScript files produced 543 baseline diagnostics and 543 candidate diagnostics, with no added diagnostics. The production build passes.
• No real cloud credentials, OAuth approvals, live Azure AAD, or AWS credential-chain logins were used. External credential helper subprocesses and cloud instance metadata credential discovery retain their own networking behavior; provider-scoped proxy does not change process-wide environment variables.