feat: replace HTTP health check with TLS handshake

Replace _http_check (HTTP GET to httpbin.org) with _tls_check that
performs a TLS handshake through the proxy chain. Multiple targets
(google, cloudflare, amazon) rotated round-robin eliminate the single
point of failure. Lighter, faster, harder to block than HTTP.

- Add test_targets config field (replaces test_url)
- Backward compat: legacy test_url extracts hostname automatically
- Add ssl.create_default_context() and round-robin index to ProxyPool
- Update docs (example.yaml, USAGE.md, CHEATSHEET.md)

docs/USAGE.md

@@ -59,7 +59,10 @@ proxy_pool:
     - file: /etc/s5p/proxies.txt
   refresh: 300
   test_interval: 120
-  test_url: http://httpbin.org/ip
+  test_targets:                     # TLS handshake targets (round-robin)
+    - www.google.com
+    - www.cloudflare.com
+    - www.amazon.com
   test_timeout: 15
   test_concurrency: 5
   max_fails: 3
@@ -107,7 +110,10 @@ proxy_pool:
     - file: /etc/s5p/proxies.txt  # text file, one proxy URL per line
   refresh: 300              # re-fetch sources every 300 seconds
   test_interval: 120        # health test cycle every 120 seconds
-  test_url: http://httpbin.org/ip  # URL for health checks
+  test_targets:             # TLS handshake targets (round-robin)
+    - www.google.com
+    - www.cloudflare.com
+    - www.amazon.com
   test_timeout: 15          # per-test timeout (seconds)
   test_concurrency: 5       # parallel health tests
   max_fails: 3              # evict after N consecutive failures
@@ -134,8 +140,9 @@ http://proxy.example.com:8080
 ### Health testing
 
 Each cycle tests all proxies through the full chain (static chain + proxy)
-by sending an HTTP GET to `test_url`. Proxies are marked alive on `200` response.
-After `max_fails` consecutive failures, a proxy is evicted.
+by performing a TLS handshake against one of the `test_targets` (rotated
+round-robin). A successful handshake marks the proxy alive. After `max_fails`
+consecutive failures, a proxy is evicted.
 
 Before each health test cycle, the static chain is tested without any pool
 proxy. If the chain itself is unreachable (e.g., Tor is down), proxy tests