feat(proxies): show how many egress IPs actually served a proxy pool

[maxmad64bis]

Summary

A pool of 12 members reads as 12 exits, but several members can share one real exit, so a single refused exit can stall the whole pool at once. The proxy log already records which entry served each connection and which exit it left by, so the pool editor now shows one line under the member list: distinct exits used, connections through them, and the busiest exit over the last 24 h. When the read fails or is turned off, the line stays hidden and the pool screen works exactly as before.

Related Issues

• Related to feat(providers): A subscription's tunnelled nodes all register as one proxy, so its pool has a single egress #13460 (a pool that reports hundreds of members while leaving through one exit)
• Related to feat: native proxy-pool round-robin / egress IP rotation across multiple proxies #6365 (the pool rotation this line observes)
• Related to feat(resilience): lock all connections of a shared egress IP together on IP-bucketed 429 #10880 (the shared-exit cooldown that makes the busiest-exit number worth showing)
• Related to feat(proxy-logs): keep the HTTP status the provider actually returned #13580 (merged; its file-size baseline note and this one are both kept)
• Related to fix(proxies): keep the stored status when a write does not send one #13577 (also edits ProxyRegistryManager.tsx)

Validation

• Change type: UI / DB
• Focused tests and category gates from the golden path — node 19/19 (# pass 19 # fail 0), vitest 6/6 (2 files), file-size / api-docs-refs / route-validation / typechecks green on the commit
• npm run lint — ESLint on the touched files is clean (exit 0); the full npm run lint was not replayed, so this stays unchecked
• Reconciled with the current active release base; focused checks rerun afterward — rebased onto the release head (238cb1b07, which now includes feat(proxies): stop re-serving a proxy that just failed #13578 and feat(proxy-logs): keep the HTTP status the provider actually returned #13580), 0 behind, single commit; the only conflict was config/quality/file-size-baseline.json, resolved by keeping both rebaseline keys
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxy-pool-egress-observation.test.ts (new, 7 tests: 12 connections through 3 members across 5 exits reading 12 / 5 / 4, out-of-pool rows ignored, NULL egress/connection ignored, rows older than 24 h ignored, empty pool returning zeros, key alias sharing one cache entry with account, injected SQL failures returning null)
• tests/unit/proxy-pool-egress-observation-route.test.ts (new, 5 tests: shape of the JSON keys, zeros contract, 400s on missing params, failure answering null with 200; run together with the pool route suite for 19/19)
• tests/unit/ui/PoolEgressObservation.test.tsx (new, 5 tests: rendered line with plurals, empty-traffic sentence, null rendering nothing, network error rendering nothing; run with the registry render test for 6/6)

Coverage Notes

The query, the service (cache, kill-switch, failure-to-null), the route (auth tier, 400s, null), and the component (line, empty sentence, hidden states) are covered directly. The OpenAPI gates only check the path is present, so the new path entry is deliberately minimal and a documenting follow-up (response schema, 400, 401) is still owed. i18n-vi-completeness reports # pass 1 # fail 4, identical to the base before this change.

Reviewer Notes

• The read is one query in src/lib/db/proxyLogs.ts:85, joining log rows to registry members through current assignments and grouping by observed exit IP; only counts leave the function, never addresses.
• The route (src/app/api/settings/proxies/pool/egress-observation/route.ts:12) sits behind the same management auth as the pool route, validates scope/scopeId itself (route.ts:18), and the pool route is untouched, so a broken observation can never break the pool editor.
• The service (src/lib/proxyPoolEgressObservation.ts:29) normalizes the scope exactly like the pool read, caches a result for 30 seconds (200 entries max), caches only successes, and turns every failure into null, which hides the line (PoolEgressObservation.tsx:40).
• Exception to the default-off rule: this read is on by default because it's read-only with no effect on routing; PROXY_POOL_EGRESS_OBSERVATION=false (or 0, no, off) turns it off (proxyPoolEgressObservation.ts:24).
• The query plan stays on existing indexes, no new index or column: SEARCH l USING INDEX idx_pl_timestamp (timestamp>?), SEARCH r USING INDEX idx_proxy_registry_host (host=?), SEARCH proxy_assignments USING COVERING INDEX sqlite_autoindex_proxy_assignments_1 (scope=? AND scope_id=?), USE TEMP B-TREE FOR GROUP BY. Full EXPLAIN QUERY PLAN output:
• [{"detail": "SEARCH l USING INDEX idx_pl_timestamp (timestamp>?)"}, {"detail": "SEARCH r USING INDEX idx_proxy_registry_host (host=?)"}, {"detail": "LIST SUBQUERY 1"}, {"detail": "SEARCH proxy_assignments USING COVERING INDEX sqlite_autoindex_proxy_assignments_1 (scope=? AND scope_id=?)"}, {"detail": "CREATE BLOOM FILTER"}, {"detail": "USE TEMP B-TREE FOR GROUP BY"}, {"detail": "USE TEMP B-TREE FOR count(DISTINCT)"}]
• Messages were added in en and vi only (src/i18n/messages/en.json:10967); the 49 other locales don't have these keys, like 9 keys already missing at the base, and the UI sync script was deliberately not run to avoid rewriting unrelated keys.
• ProxyRegistryManager.tsx grows by exactly 2 lines (import at :11, mount under the members label at :1242) with its file-size cap raised 1475 → 1477 and a rebaseline note; everything else lives in new files under the cap.
• Inherited reds, unchanged by this PR and citing none of its files: env-doc sync (six OMNIROUTE_* vars), docs-counts sync (provider counts), i18n-vi-completeness (# pass 1 # fail 4, same as base).
• The baseline conflict with feat(proxy-logs): keep the HTTP status the provider actually returned #13580 is already resolved in this rebase: both _rebaseline_… keys and both caps are kept (ProxyRegistryManager.tsx 1477 here, proxyFetch.ts 1275 from feat(proxy-logs): keep the HTTP status the provider actually returned #13580).
• fix(proxies): keep the stored status when a write does not send one #13577 edits ProxyRegistryManager.tsx far from the import and the mount added here and adds no net line, so the 1477 cap stays right in any merge order. feat(proxies): stop re-serving a proxy that just failed #13578 adds its env var to .env.example and ENVIRONMENT.md at a different spot.