add ssl_first: try SSL handshake before secondary check

When ssl_first=1 (default), proxy validation first attempts an SSL
handshake. If it fails, falls back to the configured secondary check
(head, judges, or irc). This separates SSL capability detection from
basic connectivity testing.

New config options:
- ssl_first: enable SSL-first pattern (default: 1)
- checktype: secondary check type (head, judges, irc)

config.ini.sample

@@ -18,12 +18,13 @@ profiling = 0
 # Database file for proxy storage
 database = proxies.sqlite
 
-# Check type(s): judges, ssl, irc, head, tor (comma-separated for random selection)
+# SSL-first mode: try SSL handshake first, fallback to secondary check on failure
+ssl_first = 1
+
+# Secondary check type (used when ssl_first fails, or as primary when ssl_first=0)
 #   judges  - HTTP judge servers that echo back request headers
-#   ssl     - TLS handshake test (port 443, verifies MITM)
 #   irc     - IRC server connection test (port 6667)
 #   head    - HTTP HEAD request test (port 80)
-#   tor     - Tor exit check via check.torproject.org (port 80)
 checktype = head
 
 # Thread configuration