feat: route raw TCP traffic through SOCKS5 proxy

Add create_connection and open_connection helpers to the shared proxy
module, covering portcheck, whois, tlscheck, and crtsh live-cert check.
UDP-based plugins (dns, blacklist, subdomain) stay direct.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/portcheck.py

@@ -1,4 +1,4 @@
-"""Plugin: async TCP port scanner (pure stdlib)."""
+"""Plugin: async TCP port scanner (SOCKS5-proxied)."""
 
 from __future__ import annotations
 
@@ -6,6 +6,7 @@ import asyncio
 import ipaddress
 import time
 
+from derp.http import open_connection as _open_connection
 from derp.plugin import command
 
 _TIMEOUT = 3.0
@@ -49,7 +50,7 @@ async def _check_port(host: str, port: int, timeout: float) -> tuple[int, bool,
     t0 = time.monotonic()
     try:
         _, writer = await asyncio.wait_for(
-            asyncio.open_connection(host, port), timeout=timeout,
+            _open_connection(host, port, timeout=timeout), timeout=timeout,
         )
         rtt = (time.monotonic() - t0) * 1000
         writer.close()