fix: fetcher proxy support, Dockerfile sing-box, rename index format

1. sslinks 403: Cloudflare blocks server IP. Add fetcher.proxy_url config
   so subscription/flow requests can route through an HTTP proxy.

2. Egress probe: Docker image lacked sing-box. Install sing-box v1.11.4
   in the Alpine runtime stage.

3. Collection rename: group by display baseName instead of internal
   groupKey, format index as -N instead of %02d. Fixes double-suffix
   issue where EnsureUniqueProxyNames appended -2/-3 onto existing  02.

config/config.example.yaml

@@ -24,6 +24,7 @@ fetcher:
   max_source_urls: 8
   max_response_bytes: 2097152     # 2 MiB
   max_total_bytes: 12582912       # 12 MiB
+  proxy_url: ""                   # e.g. "http://127.0.0.1:7890" for fetching sources behind Cloudflare
 
 recycle:
   max_entries: 50