Surface proxy request denials to the deployer

[rajivnathan]

Mechanism to make it easier for users to configure the proxy based on proxy denials.

Step 1: Proxy directly surfaces denials to the deployer

1. Update the deployer to accept denial events from the proxy
2. Update the proxy to send denial events that include the denied request's details to the deployer.
3. Display proxy request denials in the deployer and controls for automatically adding proxy config to allow the request in the future

Step 2: Custom operator plugin surfaces proxy denial events to the OpenClaw session

Install a custom plugin that hooks into OpenClaw's tool_result_persist hook that runs on the hot path before tool results are written to the session transcript so that it can surface requests that were blocked by the proxy along with a link/button to the Dashboard to allow the request.