feat: route raw TCP traffic through SOCKS5 proxy

Add create_connection and open_connection helpers to the shared proxy
module, covering portcheck, whois, tlscheck, and crtsh live-cert check.
UDP-based plugins (dns, blacklist, subdomain) stay direct.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/crtsh.py

@@ -7,12 +7,12 @@ totals (expired/valid), and flag domains still serving expired certs.
 import asyncio
 import json
 import logging
-import socket
 import ssl
 import urllib.request
 from concurrent.futures import ThreadPoolExecutor
 from datetime import datetime, timezone
 
+from derp.http import create_connection as _create_connection
 from derp.http import urlopen as _urlopen
 from derp.plugin import command
 
@@ -43,7 +43,7 @@ def check_live_cert(domain: str) -> dict | None:
     for ctx_factory in (_make_verified_ctx, _make_unverified_ctx):
         ctx = ctx_factory()
         try:
-            with socket.create_connection((domain, 443), timeout=10) as sock:
+            with _create_connection((domain, 443), timeout=10) as sock:
                 with ctx.wrap_socket(sock, server_hostname=domain) as ssock:
                     return ssock.getpeercert()
         except (OSError, ssl.SSLError):