feat(db): add per-proxy egress IP lookup by host and port - #14250

⚠️ base-red inherited: #13866

Summary

Proxy log lines already persist the egress address, but only per connection. This adds a persisted per-proxy lookup by host and port, so operators can tell whether two proxies actually leave through the same address. Read-only addition; no selection, routing, or status behavior changes.

Related Issues

No linked issue — small additive lookup with no prior report.

Validation

• Change type: DB
• Focused tests and category gates from the golden path
• npm run lint — ESLint on the two touched files is clean; the full run is red on the base (🔴 Release branch not green: release/v3.8.51 #13866), unrelated to this diff
• Reconciled with the current active release base; focused checks rerun afterward (01f06eae, 0 behind, gates re-run at this head)
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxy-logs-egress-ip-by-proxy.test.ts (new, 7 cases RED-then-GREEN: latest write wins, unknown pair returns null, IPv6 form, port guard, raw old row without host/port, rotation-safe Latest-wins, null never throws)
• Neighbors re-run green: proxy-logs-egress-lookup-10880, proxy-logs-egress-ip, proxy-pool-egress-observation, egress-ip-lock-10880, egress-lock-allowlist-10880 (36 pass)

Coverage Notes

• src/lib/db/proxyLogs.ts is covered by the new test file (7 cases over the single new function).
• No coverage movement in touched files beyond the addition.

Reviewer Notes

• File-size gate: pass. Complexity gate: pass (2903 vs baseline 3218). typecheck:core: clean. ESLint on touched files: clean.

• Port arrives typed as a number; callers pass through, no coercion at the read site. IPv6 zone suffixes are stripped before matching.

• No migration: reads the existing egress_ip column written by the current logger.

• CI qualification (inherited, non-blocking): API Route Typecheck 2xTS2677 (rerankProviderNodes.ts, antigravity.ts), dashboard-typecheck 3 lines, ESLint 60 lines, env-sync 5, skills-sync omni-version-manager, Unit shards 32 fails - all identical to third-party PR fix(translator): parse DeepSeek Web DSML tool calls #14249 on the same base (comm empty), files outside this diff. Non-blocking.

• CI reds are inherited from the red base (🔴 Release branch not green: release/v3.8.51 #13866), not from this diff: the third-party PR fix(sse): treat antigravity empty completions with a normal stop as valid 200s (#14160) #14243 on the same base release/v3.8.51 fails the same 9 jobs (API Route Typecheck, Docs Gates, Fast Quality Gates, Merge integrity, ESLint, Unit fast-path 1-4/4); every file cited by the failing gates is outside this diff. Non-blocking for this PR.