feat: listener retry override, pool protocol filter, conn pool docs

- Per-listener `retries` overrides global default (0 = inherit)
- Pool-level `allowed_protos` filters proxies during merge
- Connection pooling documented in CHEATSHEET.md
- Both features exposed in /config and /status API responses
- 12 new tests (config parsing, API exposure, merge filtering)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

config/example.yaml

@@ -28,6 +28,7 @@ chain:
 #     sources:
 #       - url: http://10.200.1.250:8081/proxies/all
 #         mitm: false                 # filter: mitm=0 query param
+#     allowed_protos: [socks5]        # only accept socks5 from sources
 #     state_file: /data/pool-clean.json
 #     refresh: 300
 #     test_interval: 120
@@ -115,6 +116,7 @@ chain:
 #
 #   - listen: 0.0.0.0:1081
 #     pool: clean
+#     retries: 5                         # override global retries for this listener
 #     chain:
 #       - socks5://127.0.0.1:9050
 #       - pool                           # bare: uses default "clean"