feat: route plugin HTTP traffic through SOCKS5 proxy

Add PySocks dependency and shared src/derp/http.py module providing
proxy-aware urlopen() and build_opener() that route through
socks5h://127.0.0.1:1080. Subclassed SocksiPyHandler passes SSL
context through to HTTPS connections.

Swapped 14 external-facing plugins to use the proxied helpers.
Local-only traffic (SearXNG, raw DNS/TLS sockets) stays direct.
Updated test mocks in test_twitch and test_alert accordingly.

plugins/rss.py

@@ -5,12 +5,12 @@ from __future__ import annotations
 import asyncio
 import json
 import re
-import ssl
 import urllib.request
 import xml.etree.ElementTree as ET
 from datetime import datetime, timezone
 from urllib.parse import urlparse
 
+from derp.http import urlopen as _urlopen
 from derp.plugin import command, event
 
 # -- Constants ---------------------------------------------------------------
@@ -111,10 +111,8 @@ def _fetch_feed(url: str, etag: str = "", last_modified: str = "") -> dict:
     if last_modified:
         req.add_header("If-Modified-Since", last_modified)
 
-    ctx = ssl.create_default_context()
-
     try:
-        resp = urllib.request.urlopen(req, timeout=_FETCH_TIMEOUT, context=ctx)
+        resp = _urlopen(req, timeout=_FETCH_TIMEOUT)
         result["status"] = resp.status
         result["body"] = resp.read()
         result["etag"] = resp.headers.get("ETag", "")