Proxy Error Handling

The sandbox proxy now provides more specific error messages for connection failures:

• "CONNECT handshake timed out" — timeout during proxy CONNECT
• "Proxy closed during CONNECT handshake" — premature close
• "Proxy refused CONNECT: ..." — non-2xx response from proxy
• "CONNECT response header too large" — headers exceeding 16KB
• "Denying malformed host: ..." / "Rejecting malformed SOCKS host: ..." — input validation
• "Invalid destination host for CONNECT" / "Invalid destination port" — bad target validation
• "Invalid parent proxy URL, ignoring: ..." — misconfigured parent proxy URL
• "unsupported scheme or empty host" — bad proxy URL scheme