v0.1.2 — remove unused proxy code; supply-chain reduction

Removes the proxy code path that became dead code after the v0.1.1 USE_PROXY=false default. Pure hygiene + supply-chain reduction.

What's in this release

Supply-chain reduction

• Removed https-proxy-agent and socks-proxy-agent from runtime dependencies. Both packages are pure attack surface for a medical-data bridge — neither is referenced anywhere in the production code path now that the default is safe.
• Deleted src/carelink/proxy.ts (94 lines). The loadProxyList, createProxyAgent, and ProxyRotator helpers had no remaining callers after the v0.1.1 default change.
• Removed USE_PROXY env var, the https.txt config file, and the corresponding .gitignore / .env.example entries.

Behavioural fix (incidental)

• The previous fetch() had maxRetry = this.proxyRotator.hasProxies ? 10 : 1 — meaning default users got exactly 1 retry attempt, masked by the proxy-aware logic. New code: 3 attempts with exponential backoff (2s, 4s, 8s). This is a strict improvement for everyone; no regressions.

Migration for power users

If you were using https.txt + USE_PROXY=true to route CareLink traffic through a proxy:

# Before
echo "1.2.3.4:8080" > https.txt
USE_PROXY=true npm start

# After
HTTPS_PROXY=http://1.2.3.4:8080 npm start
# (or with auth: HTTPS_PROXY=http://user:pass@1.2.3.4:8080)

axios respects HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / NO_PROXY natively. No bridge-specific config required.

Verification

• npx tsc --noEmit: clean
• npm test: 27/27 pass
• npm audit --omit=dev: 0 vulnerabilities
• Net diff: -146 / +18 lines

Credits

PR #4 by @NovaLux12.

Upstream relationship

No upstream PR — this is a deliberate security choice (removing attack surface). Documented in the PR's "Why" section. If upstream becomes active again, this divergence is a candidate for upstream discussion.