fix(webui): place web proxy with web access settings - #6161

Summary

Move the existing web proxy and User-Agent controls to Settings → Capabilities → Web access → Configure → Advanced options. Remove their old Advanced-page location. Users can set the proxy before they enable web access.

The help text explains that this proxy applies to the agent's web search and page reading. It does not configure model providers, MCP, or the user's browser. 127.0.0.1 is the gateway machine. An empty field uses the default network settings, including proxy environment variables.

Compatibility

Keep the existing tools.web.proxy setting, runtime-settings API, validation, save status, and restart behavior. There is no migration or change to proxy routing, SSRF checks, tool schemas, or prompts. Older hosts without runtime settings do not show the extra controls. Reuse the existing settings controls and styles; update all supported translations and configuration docs.

Verification

• 103 Python tests for runtime settings, web search, and web fetch security passed.
• 57 WebUI capability/system/runtime-config tests passed, including disabled web access, proxy save and clear, draft preservation across page changes, restart-required status, and removal of the duplicate editor. Update the old runtime-config test to use the relocated editor.
• WebUI lint/build and focused Ruff checks passed.
• An isolated real gateway and browser saved a proxy, reloaded it, then cleared it. The config file confirmed each value and unchanged model-provider proxy settings. Web access stayed disabled.
• Existing transport tests cover explicit/environment proxy routing and proxy errors. This UI change did not call a real external proxy or a model. Physical mobile devices were not tested.

Keep this PR as a draft.