feat: add HTTP CONNECT proxy support for Telegram and Claude API

Enable ESP32-S3 to reach api.telegram.org and api.anthropic.com through
an HTTP CONNECT proxy (e.g. Clash Verge), required in regions where
these services are blocked.

- New proxy module (http_proxy.c/h): CONNECT tunnel + TLS via esp_tls
  with pre-connected socket injection (esp_tls_set_conn_sockfd)
- Telegram and LLM modules split into direct/proxy paths
- CLI commands: set_proxy <host> <port>, clear_proxy
- Proxy config persisted in NVS
- Fix TLS buffer: MBEDTLS_SSL_IN_CONTENT_LEN 4096 → 16384
- Increase task stacks for TLS overhead (poll 12KB, agent 12KB, outbound 8KB)
- Default model changed to claude-opus-4-6
- Capture raw error body for non-200 API responses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

main/proxy/http_proxy.h

@@ -0,0 +1,48 @@
+#pragma once
+
+#include "esp_err.h"
+#include <stddef.h>
+#include <stdbool.h>
+
+/**
+ * Initialize proxy module — loads config from NVS.
+ */
+esp_err_t http_proxy_init(void);
+
+/**
+ * Returns true if a proxy host:port is configured.
+ */
+bool http_proxy_is_enabled(void);
+
+/**
+ * Save proxy host and port to NVS.
+ */
+esp_err_t http_proxy_set(const char *host, uint16_t port);
+
+/**
+ * Remove proxy config from NVS.
+ */
+esp_err_t http_proxy_clear(void);
+
+/* ── Proxied HTTPS connection ─────────────────────────────────── */
+
+typedef struct proxy_conn proxy_conn_t;
+
+/**
+ * Open an HTTPS connection through the configured proxy.
+ * 1) TCP connect to proxy
+ * 2) Send HTTP CONNECT to target host:port
+ * 3) TLS handshake over the tunnel
+ *
+ * Returns NULL on failure.
+ */
+proxy_conn_t *proxy_conn_open(const char *host, int port, int timeout_ms);
+
+/** Write raw bytes through the TLS tunnel. Returns bytes written or -1. */
+int proxy_conn_write(proxy_conn_t *conn, const char *data, int len);
+
+/** Read raw bytes from the TLS tunnel. Returns bytes read or -1. */
+int proxy_conn_read(proxy_conn_t *conn, char *buf, int len, int timeout_ms);
+
+/** Close and free the connection. */
+void proxy_conn_close(proxy_conn_t *conn);