HttpClientBuilder.Build() ignores HTTP(S)_PROXY (auth-server OAuth/DCR calls bypass forward proxy)

Problem

• HttpClientBuilder.Build() (pkg/networking/http_client.go) builds its http.Transport without a Proxy field.
• That means clients it produces ignore HTTP_PROXY / HTTPS_PROXY / NO_PROXY (a zero-value http.Transport has Proxy: nil, unlike http.DefaultTransport).
• The embedded auth server's upstream OAuth/DCR client is built this way (pkg/authserver/upstream/oauth2.go → newHTTPClientForHost → NewHostScopedClientBuilder().Build()).
• Where the upstream is only reachable via an explicit forward proxy, the token-exchange and DCR calls bypass the proxy and fail even with the proxy env vars set.
• The vMCP tool-forwarding path is unaffected, since it uses CloneDefaultTransportWithDialControl, which already sets Proxy: http.ProxyFromEnvironment.

flowchart LR
    Pod["MCPRemoteProxy pod<br/>(HTTPS_PROXY set)"]

    Pod -->|"tool-forwarding client<br/>CloneDefaultTransportWithDialControl"| P1["honors proxy"]
    Pod -->|"auth-server OAuth client<br/>Build → Proxy: nil"| P2["ignores proxy"]

    P1 --> FP["forward proxy"] --> UP1["upstream MCP host<br/>reachable"]
    P2 --> DIRECT["direct egress"] --> UP2["IP-allowlisted token<br/>endpoint → 403"]

    classDef ok fill:#e7f7ec,stroke:#2e7d32,color:#1b3d24;
    classDef bad fill:#fdecea,stroke:#c62828,color:#5b1a15;
    class P1,FP,UP1 ok;
    class P2,DIRECT,UP2 bad;

Expected behavior

• Clients built by HttpClientBuilder.Build() honor HTTP(S)_PROXY / NO_PROXY, consistent with http.DefaultTransport and the vMCP path.

Proposed fix

• Set Proxy: http.ProxyFromEnvironment on the transport in Build().
• When the proxy address is itself private, the existing AllowPrivateIPs option covers reaching it.

I'm planning to submit a PR for this.

Start in pkg/networking/http_client.go and inspect HttpClientBuilder.Build(), then trace its use through pkg/authserver/upstream/oauth2.go and newHTTPClientForHost. Verify that the built client honors HTTP_PROXY, HTTPS_PROXY, and NO_PROXY consistently with the vMCP transport, including the existing AllowPrivateIPs behavior; run the relevant Go tests after making the change.