Add support for proxying requests with API keys from proxy records

[KallynGowdy]

Adds a proxy resource kind and a ProxyController so that experiences
can call services that are secured by an API key without ever shipping the
API key to the browser.

Proxy records store the host that requests are sent to along with a data
object that describes the properties to apply to the target request. The
supported properties are body.{property}, headers.authorization, and
headers.authorization.bearer. Every other property is rejected, and a proxy
that sets body properties rejects requests that don't contain JSON data.

Actions:

• os.recordProxy() / POST /api/v2/records/proxy
• os.getProxy() / GET /api/v2/records/proxy
• os.listProxies(), os.listProxiesByMarker() / GET /api/v2/records/proxy/list
• os.eraseProxy() / DELETE /api/v2/records/proxy
• os.proxyRequest() / POST /api/v2/records/proxy/request

Security:

• Proxies are private by default. The publicRead marker grants proxy.run
  so that anyone can call the proxy without being able to read its data.
• Proxy hosts are resolved to IP addresses before requests are sent and the
  connection is pinned to the verified address so that a proxy cannot be used
  to reach services on the internal network.

Also adds proxy subscription features, Prisma/SQLite stores and migrations,
and the invalid_proxy_host and proxy_request_failed error codes.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01EMZ8tRmuQR7TqXWzH48gND

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}