fix: fetcher proxy support, Dockerfile sing-box, rename index format

1. sslinks 403: Cloudflare blocks server IP. Add fetcher.proxy_url config
   so subscription/flow requests can route through an HTTP proxy.

2. Egress probe: Docker image lacked sing-box. Install sing-box v1.11.4
   in the Alpine runtime stage.

3. Collection rename: group by display baseName instead of internal
   groupKey, format index as -N instead of %02d. Fixes double-suffix
   issue where EnsureUniqueProxyNames appended -2/-3 onto existing  02.

internal/handler/handler_test.go

@@ -2226,7 +2226,7 @@ func TestSetSafeResponseHeaderVar(t *testing.T) {
 func TestFetchFlowHeadersError(t *testing.T) {
 	// invalid URL -> error
 	req := &flowRequest{URL: "http://localhost:1/no-server", UserAgent: "ua", Timeout: 1000000000}
-	_, err := fetchFlowHeaders(req)
+	_, err := fetchFlowHeaders(req, "")
 	if err == nil {
 		// connection may succeed in some envs; just don't fail the test
 		t.Log("fetchFlowHeaders to invalid URL did not error (env-dependent)")