Add configurable HTTP/SOCKS5 network proxy (#10)

Adds a Settings UI to route Vega through an HTTP or SOCKS5 proxy (e.g. Tor).

Covers both network stacks: the webview (proxy_url applied at build time, so
relay WebSocket traffic is proxied) and all five Rust-side plugin-http call
sites (converted to fetchWithProxy). The auto-updater's check and download are
also routed via check({ proxy }), so update traffic no longer bypasses the
proxy and leaks the user's IP.

socks5h:// is intentionally rejected for now: Tauri's webview proxy API only
documents http and socks5, so accepting socks5h globally would imply a DNS-leak
guarantee the webview can't yet make. Tracking a cross-platform DNS-leak test
as follow-up.

By Anderseta.

src-tauri/Cargo.toml

@@ -18,18 +18,21 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-tauri = { version = "2", features = ["devtools", "tray-icon"] }
+tauri = { version = "2", features = ["devtools", "tray-icon", "macos-proxy"] }
 # Resolves the per-platform data/config roots before Tauri exists — the identifier
 # migration must run before tauri::Builder, so it cannot use app.path().
 dirs = "6"
 tauri-plugin-opener = "2"
 tauri-plugin-updater = "2"
+# The updater uses reqwest 0.13. Enabling its SOCKS feature here is unified with
+# that transitive dependency, so updater checks and downloads accept socks5://.
+reqwest = { version = "0.13", default-features = false, features = ["socks"] }
 tauri-plugin-process = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
 rusqlite = { version = "0.32", features = ["bundled"] }
-tauri-plugin-http = "2.5.7"
+tauri-plugin-http = { version = "2.5.7", features = ["socks"] }
 tauri-plugin-dialog = "2.7.0"
 tauri-plugin-fs = "2.5.0"
 tauri-plugin-notification = "2.3.3"
@@ -42,4 +45,3 @@ futures-util = "0.3"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 webkit2gtk = "2.0"
-