fix: honor no_proxy for environment-configured HTTP proxies

[emecii]

• I added a entry in changelog under unreleased section.
• This is not an AI slop.

Fixes #583.

ECA currently sends internal model/API requests through its configured HTTP proxy even when no_proxy names the destination. Read no_proxy (falling back to NO_PROXY) and select a direct route for matching hosts in the existing Hato HTTP/HTTPS proxy selector.

The bypass list supports case-insensitive host/domain matching, dot-boundary subdomains, exact IP literals, and a standalone *. Lowercase takes precedence, including an empty value. Documentation specifies that CIDR ranges, port-qualified entries, and partial wildcards are unsupported. Other HTTP clients and JVM-global proxy settings are outside this change.

Validation:

• Both network/client namespaces pass: 14 tests, 122 assertions. The new regressions fail on the original source with 26 assertion failures.
• Real loopback HTTP servers verify direct versus proxy routing through Hato. Selector tests cover HTTPS; successful end-to-end TLS bypass was not tested.
• Changed-file clj-kondo and formatting pass. Repository-wide lint reports one error and 16 warnings, identical on the base revision (the error is the existing unresolved dir in hooks_test.clj).
• Full integration suites and native-image/platform builds were not run locally.

AI assistance: OpenAI Codex (GPT-6) was used for investigation, implementation, review, and test execution.