add ssl_first: try SSL handshake before secondary check

When ssl_first=1 (default), proxy validation first attempts an SSL
handshake. If it fails, falls back to the configured secondary check
(head, judges, or irc). This separates SSL capability detection from
basic connectivity testing.

New config options:
- ssl_first: enable SSL-first pattern (default: 1)
- checktype: secondary check type (head, judges, irc)

config.py

@@ -51,8 +51,8 @@ class Config(ComboParser):
         if self.ppf.max_fail < 1:
             errors.append('ppf.max_fail must be >= 1')
 
-        # Validate checktypes (comma-separated list)
-        valid_checktypes = {'irc', 'head', 'judges', 'ssl'}
+        # Validate checktypes (secondary check types, ssl is handled by ssl_first)
+        valid_checktypes = {'irc', 'head', 'judges'}
         for ct in self.watchd.checktypes:
             if ct not in valid_checktypes:
                 errors.append('watchd.checktype "%s" invalid, must be one of: %s' % (ct, ', '.join(sorted(valid_checktypes))))
@@ -111,7 +111,8 @@ class Config(ComboParser):
         self.add_item(section, 'stale_days', int, 30, 'days after which dead proxies are removed (default: 30)', False)
         self.add_item(section, 'stats_interval', int, 300, 'seconds between status reports (default: 300)', False)
         self.add_item(section, 'tor_safeguard', bool, True, 'enable tor safeguard (default: True)', False)
-        self.add_item(section, 'checktype', str, 'ssl', 'check type(s): irc, head, judges, ssl (comma-separated for random)', False)
+        self.add_item(section, 'checktype', str, 'head', 'secondary check type: irc, head, judges (used when ssl_first fails)', False)
+        self.add_item(section, 'ssl_first', bool, True, 'try SSL handshake first, fallback to checktype on failure (default: True)', False)
         self.add_item(section, 'scale_cooldown', int, 10, 'seconds between thread scaling decisions (default: 10)', False)
         self.add_item(section, 'scale_threshold', float, 10.0, 'min success rate % to scale up threads (default: 10.0)', False)