feat: replace HTTP health check with TLS handshake

Replace _http_check (HTTP GET to httpbin.org) with _tls_check that
performs a TLS handshake through the proxy chain. Multiple targets
(google, cloudflare, amazon) rotated round-robin eliminate the single
point of failure. Lighter, faster, harder to block than HTTP.

- Add test_targets config field (replaces test_url)
- Backward compat: legacy test_url extracts hostname automatically
- Add ssl.create_default_context() and round-robin index to ProxyPool
- Update docs (example.yaml, USAGE.md, CHEATSHEET.md)

docs/CHEATSHEET.md

@@ -57,6 +57,10 @@ proxy_pool:
     - file: /etc/s5p/proxies.txt
   refresh: 300       # re-fetch interval
   test_interval: 120 # health test cycle
+  test_targets:      # TLS handshake targets (round-robin)
+    - www.google.com
+    - www.cloudflare.com
+    - www.amazon.com
   max_fails: 3       # evict after N fails
   report_url: ""     # POST dead proxies (optional)
 ```