v0.2.7 — SOCKS5 proxy

Added SOCKS5 proxy: operator-side SOCKS5 server forwards traffic to implants via direct libp2p streams. Supports username/password auth (RFC 1928 + RFC 1929). CLI: socks start|list|stop|reset-creds.

Security

Implant-to-operator PubSub payloads are now encrypted with NaCl box (X25519 + XSalsa20-Poly1305). An observer on the GossipSub network can no longer read beacon registrations (hostname, username, OS, etc.) or command results in cleartext. Operator commands sent via direct streams were already protected by libp2p Noise transport encryption.