fix(proxies): classify refusal cause and hang, add bounded opt-in recovery pass

[maxmad64bis]

⚠️ base-red inherited: #13866

Summary

A destination refusing the probe was misread as a dead proxy, and refused proxies were never re-tested. This PR carries the refusal cause next to the verdict without touching proxy status, plus an opt-in recovery pass. Defaults: stalled handshakes count like frank failures, unproven 403s stay neutral, recovery off unless PROXY_HEALTH_RECOVERY_ENABLED is set.

Related Issues

• Related to fix(api): a target refusing the egress IP is not a healthy proxy #10654 (refused egress IP is not a healthy proxy).
• Related to [BUG] Massive issue with proxies since 3.8.44 - IP leak #6246 (probe outcomes stay advisory; operator owns proxy status).

Validation

• Change type: routing
• Focused tests and category gates from the golden path (25 new/updated proxy-health tests + neighbours (12+7+7), tsc filtered 0, eslint perimeter clean)
• npm run lint — touched files clean locally; the full run is red on the base (inherited, non-blocking, see Reviewer Notes)
• Reconciled with the current active release base; focused checks rerun afterward (0 behind, no realignment needed)
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxy-health-refusal-cause.test.ts (new, 5): 401/403/429/451 matrix over proven/unproven/absent; 403 without evidence neutral, never mutates.
• tests/unit/proxy-health-probe-error.test.ts (new, 3): stalled handshake vs plain local abort vs frank connection failure.
• tests/unit/proxy-health-recovery-plan.test.ts (new, 4): quota-refusal only, drops unreachable (even with 429 observation) and null keys; oldest-first with volume cut.
• tests/unit/proxy-health-recovery-pass.test.ts (updated, 4): fake probe plus real refusal memory; success lifts, failure doubles recurrence, off means zero probes.
• tests/unit/proxy-health-recovery-default.test.ts (new, 1): real default path, no injected probe (local 429 relay then 200, real registry/memory).
• tests/unit/proxy-health-decide-action-6246.test.ts (extended, 8): stalled handshake equals frank failure at/below threshold, opt-ins on/off.
• Neighbours green (12+7+7); filtered tsc 0, ESLint clean; RED-then-GREEN (new tests failed on missing imports first; default-path RED by stash, GREEN after).

Coverage Notes

• src/lib/proxyHealth/decision.ts covered by cause/probe-error/decide-action suites; scheduler.ts recovery by plan/pass/default-path suites.
• No coverage moved down; global tsc OOMs here, so evidence is the filtered run (0 errors).

Reviewer Notes

• Start at the default recovery path (probeLedgerKey shared keyed probe type) and the refusal-cause sidecar (beside the verdict, never branched into status). Pre-PR fix: the default probe took an object instead of a key string and could never recover anyone; the default-path test locks it. Registry and planner admit only quota-refusal entries: unreachable excluded twice.
• Locally green (e4ae1ac4; fix(api): a target refusing the egress IP is not a healthy proxy #10654/fix(proxy-health): refused probe responses reset the consecutive-failure streak #13608; normalized failures identical to sibling fix(sse): neutral 403 code for non-quota refusals #14234): unproven 403s neutral with no status write, 451 carried with no write, unset flag zero probes.
• CI reds are inherited from the red base (🔴 Release branch not green: release/v3.8.51 #13866), not from this diff: the third-party PR fix(sse): treat antigravity empty completions with a normal stop as valid 200s (#14160) #14243 on the same base release/v3.8.51 fails the same 9 jobs (API Route Typecheck, Docs Gates, Fast Quality Gates, Merge integrity, ESLint, Unit fast-path 1-4/4); every file cited by the failing gates is outside this diff. Non-blocking for this PR.

[diegosouzapw]

Thanks @maxmad64bis — merging via the release merge-train. Validated in local merge-train (mt-train10c) on the devbox @ train tip 4d841aa1c740bbaa03868dc0a403c62099a99a42 with the 72 sibling PRs of this batch: typecheck:core, file-size, complexity, cognitive-complexity, changelog-integrity green; changed-area node:test 831/831 (0 failing) and vitest 480/482 — the two reds are autoCombo/provider-family-combos.test.ts timing out at 20s, which reproduces on the PURE release tip under the full vitest suite (and is already tracked by the Release-Green issue #13866), so it is inherited, not this batch's. Merged --admin per merge-gates §3/§4/§7.