feat: route plugin HTTP traffic through SOCKS5 proxy

Add PySocks dependency and shared src/derp/http.py module providing
proxy-aware urlopen() and build_opener() that route through
socks5h://127.0.0.1:1080. Subclassed SocksiPyHandler passes SSL
context through to HTTPS connections.

Swapped 14 external-facing plugins to use the proxied helpers.
Local-only traffic (SearXNG, raw DNS/TLS sockets) stays direct.
Updated test mocks in test_twitch and test_alert accordingly.

plugins/subdomain.py

@@ -12,6 +12,7 @@ import socket
 import struct
 import urllib.request
 
+from derp.http import urlopen as _urlopen
 from derp.plugin import command
 
 log = logging.getLogger(__name__)
@@ -130,7 +131,7 @@ def _fetch_crtsh(domain: str) -> set[str]:
     """Fetch subdomains from crt.sh CT logs. Blocking."""
     url = _CRTSH_URL.format(domain=domain)
     req = urllib.request.Request(url, headers={"User-Agent": "derp-bot"})
-    with urllib.request.urlopen(req, timeout=_CRTSH_TIMEOUT) as resp:  # noqa: S310
+    with _urlopen(req, timeout=_CRTSH_TIMEOUT) as resp:
         data = json.loads(resp.read())
 
     subs: set[str] = set()