feat: route raw TCP traffic through SOCKS5 proxy

Add create_connection and open_connection helpers to the shared proxy
module, covering portcheck, whois, tlscheck, and crtsh live-cert check.
UDP-based plugins (dns, blacklist, subdomain) stay direct.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/tlscheck.py

@@ -1,13 +1,13 @@
-"""Plugin: TLS certificate and cipher inspector (pure stdlib)."""
+"""Plugin: TLS certificate and cipher inspector (SOCKS5-proxied)."""
 
 from __future__ import annotations
 
 import asyncio
 import hashlib
-import socket
 import ssl
 from datetime import datetime, timezone
 
+from derp.http import create_connection as _create_connection
 from derp.plugin import command
 
 _TIMEOUT = 10
@@ -35,7 +35,7 @@ def _inspect(host: str, port: int) -> dict:
     ctx.verify_mode = ssl.CERT_NONE
 
     try:
-        with socket.create_connection((host, port), timeout=_TIMEOUT) as sock:
+        with _create_connection((host, port), timeout=_TIMEOUT) as sock:
             with ctx.wrap_socket(sock, server_hostname=host) as ssock:
                 result["version"] = ssock.version() or ""
                 cipher = ssock.cipher()