Desktop and buzz-acp relay WebSocket connections ignore proxy settings

**Describe the bug**

Buzz's native relay WebSocket clients do not honor platform system proxy settings or standard proxy environment variables.

Both Desktop and `buzz-acp` establish relay connections by calling `tokio_tungstenite::connect_async(...)` directly:

- Desktop: `desktop/src-tauri/src/native_websocket.rs`
- ACP harness: `crates/buzz-acp/src/relay.rs`

That API opens a direct TCP/TLS connection. Neither path performs system-proxy discovery, reads `HTTP_PROXY` / `HTTPS_PROXY` / `ALL_PROXY` / `NO_PROXY`, nor creates an HTTP CONNECT or SOCKS tunnel.

This also creates inconsistent behavior inside Desktop: browser or WebView traffic can use the platform proxy while the persistent native relay connection bypasses it.

**Steps to reproduce**

1. Configure a platform or environment proxy and use a relay that is reachable only through that proxy.
2. Open Buzz Desktop or start `buzz-acp` with the relay URL.
3. Observe that the relay WebSocket attempts a direct connection instead of using the configured proxy.

**Expected behavior**

Relay WebSocket connections should use a proxy-aware connector. At minimum, Buzz should provide a documented explicit proxy setting and honor `NO_PROXY`. Desktop should preferably support platform system-proxy discovery, while CLI and ACP components should honor standard proxy environment variables.

`wss://` connections through an HTTP proxy require CONNECT tunneling. SOCKS5 support would also cover common development and private-network configurations.

The proxy-aware connection logic should be shared by Desktop, `buzz-acp`, and other native relay clients so their behavior does not diverge.

Useful regression coverage would include:

- successful WSS connection through a local HTTP CONNECT proxy when direct access is unavailable;
- unchanged direct behavior when no proxy is configured;
- `NO_PROXY` bypass behavior;
- proxy credentials never appearing in logs or errors.

**Version and platform**

- Buzz version: 0.4.26 and current `main`
- OS: affects native relay clients across supported platforms

**Logs / additional context**

Related implementation context:

- #2076 introduced the Buzz-owned native Desktop WebSocket adapter.
- #2940 tracks a similar browser/native-network-stack mismatch for platform certificate trust.
- #2517 addresses native certificate roots, but not proxy routing.

Start by reading the native WebSocket entry points in desktop/src-tauri/src/native_websocket.rs and crates/buzz-acp/src/relay.rs, focusing on their tokio_tungstenite::connect_async(...) calls. Define shared proxy-aware behavior for direct connections, HTTP CONNECT, environment variables, and NO_PROXY, then add coverage for proxied WSS, direct fallback, bypass behavior, and credential-safe errors.

Written by the indexing model from the issue text.