Outbound proxy: YAML config + NTLM/Basic auth support

[coopernetes]

Follow-on to #83 (env-var proxy wiring, landing in 1.0.0).

Summary

Add full server.outboundProxy YAML configuration with authentication support for environments where a direct unauthenticated local relay is not available.

Proposed config

server:
  outboundProxy:
    host: proxy.corp.example.com
    port: 8080
    auth:
      type: basic   # or ntlm
      username: ${PROXY_USER}
      password: ${PROXY_PASS}
      # NTLM only:
      domain: CORP
      workstation: myhost
    noProxy: "localhost|*.internal.example.com"

Scope

All three outbound paths must be covered:

1. JGit Transport — set Java system properties at startup; NTLM requires a custom CredentialsProvider
2. Jetty HttpClient — ProxyConfiguration.addProxy() with ProxyConfiguration.Proxy auth settings
3. Apache HC5 — DefaultProxyRoutePlanner + CredentialsProvider (NTLM via NTCredentials)

NTLM is the complex case — HC5 has built-in support via NTCredentials but Jetty's HttpClient does not natively support NTLM and may require routing through a local relay or a workaround.

Prerequisites

• Outbound proxy support for air-gapped / corporate network environments #83 merged (env-var wiring in place)

[coopernetes]

DLP/firewall note: enterprises that block non-GET traffic to SCM providers (common with DLP appliances) will see upstream push forwarding fail regardless of proxy auth config. This is a network-layer issue — the proxy host's egress IP needs to be allowlisted for POST/PUT to the SCM provider. Document this clearly alongside the YAML auth config when that ships.