feat: implement SOCKS5 proxy with stream multiplexing over HTTPS tunnel

- Add socks5.rs module with SOCKS5 protocol parsing (greeting, auth, CONNECT)
- Add /forward HTTPS endpoint on listener for target TCP forwarding
- Add SOCKS5 proxy listener on connector side with fail-closed auth gating
- Support IPv4 and hostname targets, sequential/concurrent streams
- Fail-closed behavior: SOCKS rejected before tunnel authentication
- 38 new tests covering protocol parsing, malformed input, and E2E paths

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/main.rs

@@ -3,6 +3,7 @@ mod config;
 mod errors;
 mod generate;
 mod redact;
+mod socks5;
 mod tls;
 mod tunnel;
 
@@ -246,7 +247,7 @@ fn run_connect(
         target_port
     );
     tracing::info!(
-        "SOCKS5 proxy at {}:{} is not yet implemented (scheduled for SOCKS milestone)",
+        "SOCKS5 proxy at {}:{} ready for local clients",
         socks_host,
         socks_port
     );
@@ -258,6 +259,21 @@ fn run_connect(
         redact::Redacted::new(&auth_token)
     );
 
+    // Resolve SOCKS5 bind address
+    let socks_addr = match tokio::runtime::Runtime::new()
+        .unwrap()
+        .block_on(tunnel::resolve_host(&socks_host, socks_port))
+    {
+        Ok(addrs) => addrs[0],
+        Err(e) => {
+            eprintln!(
+                "Error: failed to resolve SOCKS5 address '{}': {}",
+                socks_host, e
+            );
+            return 1;
+        }
+    };
+
     let config = ConnectorConfig {
         target_host,
         target_port,
@@ -267,10 +283,10 @@ fn run_connect(
         auth_token: Arc::new(auth_token),
     };
 
-    // Run the async connector
+    // Run the async connector with SOCKS5 proxy
     if let Err(e) = tokio::runtime::Runtime::new()
         .unwrap()
-        .block_on(tunnel::connect_tunnel(config))
+        .block_on(tunnel::run_connector_with_socks(config, socks_addr))
     {
         eprintln!("Error: {}", e);
         return 1;