feat: reach HTTPS services through an HTTP CONNECT proxy

feat: reach HTTPS services through an HTTP CONNECT proxy Adds an optional proxy setting so Karakeep can be reached when it is only routable through a local HTTP proxy. The motivating case is an e-reader running Tailscale. The KOReader Tailscale plugin forces --tun=userspace-networking unconditionally (kernel TUN trips wgengine watchdog timeouts on these devices), so tailnet addresses are only reachable via the SOCKS5/HTTP proxies it exposes on loopback. Neither library in KOReader's stack can use them for HTTPS: LuaSocket's http has no CONNECT tunnelling, and LuaSec's https module explicitly returns 'proxy not supported'. The result was a bare 'Network error occurred' with no HTTP status. proxy_tunnel.lua supplies a function for LuaSocket that dials the proxy, issues CONNECT for the real target, then upgrades the tunnelled socket to TLS with SNI set to the target host. Peer verification uses KOReader's bundled ca-bundle.crt when present rather than being disabled. Threaded through settings, the API client and the server settings dialog; an empty value means connect directly, so existing setups are unaffected.