fix(proxy): save dashboard custom proxies in registry

[terence71-glitch]

Summary

• Changes the dashboard Custom proxy save flow so newly saved Custom provider/account/global/combo proxies are written to the proxy registry and assigned via proxy_assignments, instead of creating new entries only in the legacy /api/settings/proxy config path.
• Adds and preserves a dashboard-custom proxy source marker through validation and DB CRUD, so the UI can distinguish proxies created by the dashboard Custom tab from reusable/manual saved proxies.
• Updates an existing dashboard-created Custom proxy only when it is safely owned by the current scope. If the current assignment points to a reusable/manual/shared saved proxy, the UI now creates a separate dashboard Custom registry proxy instead of mutating the shared one.
• Keeps backward compatibility with the legacy proxy config path by continuing to read legacy config and clearing the matching legacy entry only after the registry proxy and assignment save succeeds.
• When a modern registry proxy is assigned, the matching legacy Custom proxy config for that same scope is removed with DELETE /api/settings/proxy?... after the registry assignment succeeds. This prevents stale legacy Custom proxy entries from continuing to shadow or confuse the new registry assignment, while avoiding data loss if the modern save/assignment fails.
• The legacy cleanup is scoped: it only clears the same target being saved, such as the same provider/account/global/combo entry. It does not delete unrelated legacy proxy configs for other scopes and does not delete registry proxies.
• Adds focused regression coverage for this behavior, including the dashboard Custom save path, safe update of a scope-owned dashboard-custom proxy, and protection against accidental mutation of reusable manual proxies.

Closes #2601

Test coverage added

• Added tests/unit/shared/components/ProxyConfigModal.test.tsx to cover the relevant UI behavior for Custom proxy saves.
• Extended proxy registry/DB tests to verify the new source: "dashboard-custom" field is accepted, persisted, and returned correctly.

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[gemini-code-assist]

Code Review

This pull request introduces a source field to the proxy registry to distinguish between manual, automated, and dashboard-custom proxies. The ProxyConfigModal has been refactored to store 'custom' proxies directly in the registry, including logic to update existing scope-owned proxies or create new ones. Feedback identifies an opportunity to use the isSameScopeAssignment helper for safer assignment lookups and a bug in the secret handling logic that prevents clearing fields or correctly identifying redacted placeholders.

[gemini-code-assist]

It is safer to find the specific assignment for the current scope using the isSameScopeAssignment helper instead of assuming the first item in the array is the correct one.

Suggested change

	const target = items[0];
	const target = items.find((item) => isSameScopeAssignment(item, scope, scopeId)) || items[0];

[gemini-code-assist]

The condition normalizedUsername || isRedactedSecret(username) is redundant because isRedactedSecret already implies a truthy value. Furthermore, this logic prevents clearing a username because an empty string is falsy. Consider checking if the value is not the redacted placeholder instead.

Suggested change

	if (normalizedUsername || isRedactedSecret(username)) {
	updatePayload.username = normalizedUsername;
	}
	if (username !== "***") {
	updatePayload.username = normalizedUsername;
	}

[terence71-glitch]

Addressed the Gemini Code Assist suggestions in cc962b06.

Changes made:

• Assignment loading now looks for the exact matching scope/scopeId with isSameScopeAssignment(...) before falling back to the first returned item.
• Custom proxy updates now handle redacted credentials more safely:
  • username !== "***" controls whether username is sent in the update payload.
  • password !== "***" controls whether password is sent in the update payload.
  • This avoids overwriting preserved redacted credentials, while still allowing intentionally cleared credentials to be sent.
• Added regression coverage in ProxyConfigModal.test.tsx for the "***" behavior and exact assignment selection.

Verified with:

• npx vitest run tests/unit/shared/components/ProxyConfigModal.test.tsx
• node --import tsx/esm --test tests/unit/db-proxies-crud.test.ts tests/unit/proxy-registry.test.ts tests/integration/proxy-registry-flow.test.ts

[diegosouzapw]

Thanks @terence71-glitch for this clean fix! Modernizing the dashboard custom proxy flow to utilize the SQLite proxy registry and assignments instead of legacy settings is a great improvement. I've squashed and merged this into the release branch, and it will be included in the v3.8.3 release. Keep up the excellent work!