test(network): cover outbound proxy/TLS config, resolver and replay routing

[lorenzozanee]

What does this PR do?

Adds the missing test coverage for the outbound proxy/TLS feature from #102: the network config schema (including secret redaction), the Network resolver (forHost/forUrl, bypass matching, per-host client certificates, TLS precedence), and replay routing through a real local proxy.

The hackbrowser side of #102 reuses the same Network layer through forBrowser() (covered here: proxy server/bypass, SOCKS+auth refusal, certificate-error handling); the browser itself is exercised end-to-end in the existing crawler tests, so no separate hackbrowser wiring test was added.

Fixes #102

Type of change

• Bug fix
• New feature / agent
• Security tool / MCP server / Bolt plugin
• Agent skill / knowledge base
• UI / TUI improvement
• Documentation
• Refactor / performance
• CI / infrastructure

Security impact

• This PR adds or modifies tool execution (shell, file, network)
• This PR changes agent permissions or scope
• This PR modifies authentication / authorization logic
• This PR has no security impact

How did you verify it works?

bun test test/network/network.test.ts from packages/cyberstrike → 52 pass; bun turbo typecheck clean. The wire tests spin up local loopback origin + proxy servers, no external network needed.

Checklist

• bun turbo typecheck passes
• Tested locally with at least one LLM provider
• PR is focused on a single change
• No secrets, credentials, or API keys in the diff
• Breaking changes are documented (if any)

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.