fix(web_fetch): reuse network proxy resolution

[closss]

Summary

This updates web_fetch to reuse Reasonix's shared network proxy resolver instead of using a static proxy URL resolved during boot.

Before this change:

• web_fetch received a flattened proxy URL from netclient.ResolveProxyURL.
• It did not share the same per-request behavior as provider/update traffic.
• no_proxy, env/auto/custom proxy behavior, and redirect boundaries could diverge from netclient.
• Windows system proxy fallback in auto mode could not be reused by web_fetch.

After this change:

• web_fetch carries the full netclient.ProxySpec.
• It calls the shared per-request proxy resolver for every fetch round trip, including redirects.
• env, auto, custom, no_proxy, and DirectHosts now follow the same resolver path as other network clients.
• The existing SSRF guard remains in web_fetch: direct dials still vet resolved IPs, and proxied IP-literal targets are still blocked.

Issues

Fixes #3610
Fixes #3510

Implementation notes

• Exported netclient.ProxyFunc as a thin wrapper around the existing resolver.
• Replaced web_fetch's static proxyURL field with netclient.ProxySpec.
• Kept the existing HTTP CONNECT / SOCKS proxy handling and SSRF boundary in web_fetch.
• Removed the now-unused static ResolveProxyURL helper.
• Wired the proxy spec through normal boot, workspace-bound tools, and ACP tool setup.
• Updated config comments so they no longer say network proxy settings exclude web_fetch.

Tests

• go test ./internal/tool/builtin -run 'TestWebFetchUsesEnvProxyAtRequestTime|TestWebFetchProxySpecHonorsNoProxy|TestWebFetchRechecksProxySpecAfterRedirect'
• go test ./internal/tool/builtin ./internal/netclient ./internal/boot ./internal/cli
• git ls-files '*.go' | xargs ../.tools/go/bin/gofmt -l
• git diff --check
• go test ./...
• go vet ./...
• go build ./...
• go test -race ./...

[esengine]

Clean refactor — collapsing the proxy URL into ProxySpec and reusing the resolver while keeping web_fetch's SSRF guard is exactly right. Verified the CONNECT-proxy and SSRF-block paths end-to-end locally. Thanks!