feat: implement SOCKS5 proxy with stream multiplexing over HTTPS tunnel

- Add socks5.rs module with SOCKS5 protocol parsing (greeting, auth, CONNECT)
- Add /forward HTTPS endpoint on listener for target TCP forwarding
- Add SOCKS5 proxy listener on connector side with fail-closed auth gating
- Support IPv4 and hostname targets, sequential/concurrent streams
- Fail-closed behavior: SOCKS rejected before tunnel authentication
- 38 new tests covering protocol parsing, malformed input, and E2E paths

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/errors.rs

@@ -84,6 +84,9 @@ pub enum TunnelError {
     #[error("timeout: {0}")]
     #[allow(dead_code)]
     Timeout(String),
+
+    #[error("hostname error: {0}")]
+    Host(#[from] HostError),
 }
 
 /// Errors returned by the connector side.