fix: fetcher proxy support, Dockerfile sing-box, rename index format

1. sslinks 403: Cloudflare blocks server IP. Add fetcher.proxy_url config
   so subscription/flow requests can route through an HTTP proxy.

2. Egress probe: Docker image lacked sing-box. Install sing-box v1.11.4
   in the Alpine runtime stage.

3. Collection rename: group by display baseName instead of internal
   groupKey, format index as -N instead of %02d. Fixes double-suffix
   issue where EnsureUniqueProxyNames appended -2/-3 onto existing  02.

internal/config/config.go

@@ -46,6 +46,7 @@ type FetcherConfig struct {
 	MaxSourceUrls       int           `mapstructure:"max_source_urls"`
 	MaxResponseBytes    int           `mapstructure:"max_response_bytes"`
 	MaxTotalBytes       int           `mapstructure:"max_total_bytes"`
+	ProxyURL            string        `mapstructure:"proxy_url"`
 }
 
 type RecycleConfig struct {
@@ -78,6 +79,7 @@ func defaults() {
 	viper.SetDefault("fetcher.max_source_urls", 8)
 	viper.SetDefault("fetcher.max_response_bytes", 2*1024*1024)
 	viper.SetDefault("fetcher.max_total_bytes", 12*1024*1024)
+	viper.SetDefault("fetcher.proxy_url", "")
 	viper.SetDefault("recycle.max_entries", 50)
 	viper.SetDefault("app.name", "Sub-Store")
 	viper.SetDefault("app.version", "1.0.0")