feat: route raw TCP traffic through SOCKS5 proxy

Add create_connection and open_connection helpers to the shared proxy
module, covering portcheck, whois, tlscheck, and crtsh live-cert check.
UDP-based plugins (dns, blacklist, subdomain) stay direct.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/whois.py

@@ -1,10 +1,11 @@
-"""Plugin: WHOIS lookup (raw TCP, port 43, pure stdlib)."""
+"""Plugin: WHOIS lookup (raw TCP, port 43, SOCKS5-proxied)."""
 
 from __future__ import annotations
 
 import asyncio
 import ipaddress
 
+from derp.http import open_connection as _open_connection
 from derp.plugin import command
 
 # Referral servers for common TLDs
@@ -51,7 +52,7 @@ def _pick_server(target: str) -> tuple[str, str]:
 async def _whois(server: str, query: str) -> str:
     """Send a WHOIS query and return the response text."""
     reader, writer = await asyncio.wait_for(
-        asyncio.open_connection(server, 43), timeout=_TIMEOUT,
+        _open_connection(server, 43, timeout=_TIMEOUT), timeout=_TIMEOUT,
     )
     try:
         writer.write(f"{query}\r\n".encode("utf-8"))