feat: route plugin HTTP traffic through SOCKS5 proxy

Add PySocks dependency and shared src/derp/http.py module providing
proxy-aware urlopen() and build_opener() that route through
socks5h://127.0.0.1:1080. Subclassed SocksiPyHandler passes SSL
context through to HTTPS connections.

Swapped 14 external-facing plugins to use the proxied helpers.
Local-only traffic (SearXNG, raw DNS/TLS sockets) stays direct.
Updated test mocks in test_twitch and test_alert accordingly.

plugins/headers.py

@@ -8,6 +8,7 @@ import re
 import ssl
 import urllib.request
 
+from derp.http import build_opener as _build_opener
 from derp.plugin import command
 
 log = logging.getLogger(__name__)
@@ -84,9 +85,7 @@ def _fetch_headers(url: str) -> tuple[dict[str, str], str]:
     ctx.check_hostname = False
     ctx.verify_mode = ssl.CERT_NONE
 
-    opener = urllib.request.build_opener(
-        urllib.request.HTTPSHandler(context=ctx),
-    )
+    opener = _build_opener(context=ctx)
     req = urllib.request.Request(url, method="GET")
     req.add_header("User-Agent", _USER_AGENT)