fix(ai): route subscription auth through the configured proxy

[guantw]

Summary

Subscription OAuth login, token refresh, and credential resolution now honor the global AI proxy (ai.proxy). This applies to the Codex, Antigravity, and OpenCode subscription providers, whose token exchange, refresh, and account-discovery requests run outside the normal AI request client and previously ignored the proxy configuration.

Bare host:port proxy URLs (e.g. 127.0.0.1:7897) are normalized to http://host:port; explicit schemes such as socks5:// are preserved.

TLS verification for subscription-auth requests now follows the model configuration (skip_ssl_verify) and uses the same TLS backend as the main AI client.

Changes

• ai-adapters: build_http_client builds a proxy/TLS-aware client shared by all three subscription providers; build_proxy normalizes bare proxy URLs. SubscriptionHttpOptions carries the transport policy (proxy + skip_ssl_verify) through login, refresh, and resolution.
• core: client_factory resolves subscription credentials with the model's proxy and TLS settings.
• desktop: commands passes the configured AI proxy into subscription login and account refresh.

Also included

When a local token refresh loses its conditional-commit race to a concurrent refresh, the credential committed by the winner is reused if still valid, instead of always failing on a revision conflict.

Verification

• cargo fmt (changed files via format-changed-rust)
• cargo check for bitfun-ai-adapters (with subscription-auth), bitfun-core, bitfun-desktop
• cargo test for bitfun-ai-adapters (full suite), bitfun-core, bitfun-desktop

Review follow-up

• Restored the public apply_subscription_auth compatibility entry point.
• Collapsed the new transport variants to the legacy APIs plus one explicit options-based path per operation.
• Enabled Reqwest SOCKS transport in bitfun-ai-adapters, with a crate-specific dependency boundary contract and regression coverage.

Additional verification

• cargo test -p bitfun-ai-adapters --features subscription-auth (271 passed)
• cargo test -p bitfun-core --no-default-features --features ai-adapter-runtime --lib infrastructure::ai::client_factory::tests (6 passed)
• cargo check -p bitfun-desktop
• cargo test -p bitfun-desktop (283 passed, 2 ignored)
• pnpm run check:core-boundaries:test (68 passed)
• pnpm run check:core-boundaries
• git diff --check