feat(outbound): add optional RESIN_UPSTREAM_PROXY for global node egress

[muqing-kg]

Summary

Add an opt-in environment variable RESIN_UPSTREAM_PROXY that routes every managed node outbound through a configurable upstream proxy.

This is a generic dial-chain option for any SOCKS5/HTTP/HTTPS proxy. It is not tied to a specific product or vendor integration.

Motivation

Some deployments need all managed nodes to egress through an intermediate proxy instead of dialing directly from the Resin host/container.

Today Resin builds node outbounds with direct dialing. Operators who need a shared egress path must either change host networking or rewrite each node config.

This change provides a single opt-in control for that deployment pattern.

What changed

• New env var: RESIN_UPSTREAM_PROXY
• Supported forms:
  • socks5://[user:pass@]host:port
  • socks5h://[user:pass@]host:port
  • http://[user:pass@]host:port
  • https://[user:pass@]host:port
  • scheme-less host:port (treated as HTTP)
• Implementation injects a dedicated sing-box outbound and sets each node DialerOptions.Detour
• Existing node-level detours are preserved
• If the upstream proxy host is a domain name, a local DNS transport is registered for resolution
• When the env is empty, behavior is unchanged

Non-goals

• Not a product-specific integration
• Not per-node / per-platform upstream selection
• Not multi-upstream load balancing
• Not support for arbitrary non-SOCKS5/HTTP/HTTPS proxy protocols

Compatibility

• Fully opt-in
• Empty / unset RESIN_UPSTREAM_PROXY preserves current direct dialing behavior
• Existing node-level detours continue to take precedence

Docs

• .env.example documents the new variable
• FAQ entries added in README.md and README.zh-CN.md

Test plan

• go test ./internal/outbound/ -count=1
• go test ./internal/config/ -count=1
• URL parsing coverage for socks5 / http / https / scheme-less
• Auth parsing coverage
• Default ports coverage
• Detour injection and existing-detour preservation coverage
• Manual check: leave env empty and confirm direct dialing still works
• Manual check: set RESIN_UPSTREAM_PROXY=socks5://127.0.0.1:1080 and confirm node egress goes through that proxy
• Manual check: set an HTTP upstream and confirm the same
• Manual check: node with an existing detour still keeps its own detour

Example

RESIN_UPSTREAM_PROXY=socks5://127.0.0.1:1080
RESIN_UPSTREAM_PROXY=http://proxy.example.com:8080
RESIN_UPSTREAM_PROXY=https://user:pass@proxy.example.com:8443