feat: proxy auth for both CLIs (2/2 — merge after #501)

[niieani]

Adds explicit proxy auth for jtk and cfl: only a URL is required, requests send no Authorization header, and token/keyring requirements are skipped. HTTPS and loopback HTTP endpoints are accepted; remote HTTP is rejected during client construction and init, including jtk init --no-verify before any config is saved.

Merge order: 2 of 2 — merge #501 first, then this PR. This branch contains #501's gateway groundwork followed by the proxy-auth commit e0bde24. Both PRs target upstream main because we cannot create an upstream base branch. Until #501 lands, GitHub's overall diff includes both commits; the proxy-only review range is 3d9db37..e0bde24. After #501 merges, rebase this PR onto upstream main to remove the gateway changes from its diff before merging. Do not merge this PR first.

First PR: #501

This replaces the proxy-auth portion of upstream #411. It includes typed shared credential policy, consistent init validation and deferred-token behavior, both runtime paths, and all three auth passes in the integration runbooks. Existing tests remain in their original files to keep the review diff focused.

Validation: make check passed on the complete stack (module tidy, lint, race tests for all three modules, and both CLI builds). Coverage includes omitted Authorization headers, proxy config persistence without credentials, non-loopback HTTP rejection before save, and existing basic/bearer behavior.

[niieani]

@piekstra-dev this is PR 2/2, dependent on #501. Please review the proxy-only range 3d9db37..e0bde24 if incremental comparison is supported. Both target upstream main, so GitHub currently includes prerequisite gateway changes too. After #501 merges, this branch will be rebased to remove that prerequisite from its diff before merging.