fix(http): fix proxy memory leak and HTTPS proxy tunnel not triggered from env vars

Use ArenaAllocator for proxy-related allocations in std.http.Client.
Client.deinit() does not free proxy objects (they're externally-owned),
so without an arena those allocations leak — detected by DebugAllocator.

Also expand the CONNECT tunnel workaround to check environment variables
(http_proxy, https_proxy, etc.), not just the explicit proxy_url setting.
Previously, when a proxy was auto-detected from environment variables,
HTTPS requests fell through to the broken connectProxied() path that
returns HTTP 400.

Fixes two issues seen when running 'zvm remote' with http_proxy set:
  - DebugAllocator reports leaked proxy memory
  - 'Failed to fetch version map' due to connectProxied() returning 400

Affected functions:
  - http_client: downloadToFileWithProxy, downloadToMemoryWithProxy
  - mirror_probe: probeThreadMainWindows

Author: zcg

src/network/http_client.zig

@@ -53,17 +53,25 @@ pub fn downloadToFileWithProxy(
     const uri = try std.Uri.parse(url);
     const protocol = std.http.Client.Protocol.fromUri(uri) orelse return error.DownloadFailed;
 
-    // For HTTPS with proxy, manually establish a CONNECT tunnel.
-    if (protocol == .tls and proxy_url.len > 0) {
-        const proxy_info = proxy_tunnel.resolveProxy(allocator, environ_map, proxy_url);
+    // Arena for proxy-related allocations (Proxy objects, host strings).
+    // std.http.Client.deinit() does not free proxy objects (they're externally-owned),
+    // so we manage their lifetime via this arena.
+    var proxy_arena: std.heap.ArenaAllocator = .init(allocator);
+    defer proxy_arena.deinit();
+
+    // For HTTPS through a proxy, manually establish a CONNECT tunnel.
+    // Workaround for Zig's std.http.Client.connectProxied() returning 400.
+    // Checks both explicit proxy_url and environment variables (http_proxy, etc.).
+    if (protocol == .tls) {
+        const proxy_info = proxy_tunnel.resolveProxy(proxy_arena.allocator(), environ_map, proxy_url);
         if (proxy_info) |pi| {
             return downloadFileViaProxyTunnel(allocator, io, uri, pi.host, pi.port, dest_path, progress_writer);
         }
     }
 
     var client: std.http.Client = .{ .allocator = allocator, .io = io };
     defer client.deinit();
-    initClientProxy(&client, allocator, environ_map, proxy_url);
+    initClientProxy(&client, proxy_arena.allocator(), environ_map, proxy_url);
 
     var req = try client.request(.GET, uri, .{
         .redirect_behavior = .init(5),
@@ -263,23 +271,28 @@ pub fn downloadToMemoryWithProxy(
     url: []const u8,
     proxy_url: []const u8,
 ) ![]const u8 {
-    var client: std.http.Client = .{ .allocator = allocator, .io = io };
-    defer client.deinit();
+    var proxy_arena: std.heap.ArenaAllocator = .init(allocator);
+    defer proxy_arena.deinit();
 
     const uri = try std.Uri.parse(url);
     const protocol = std.http.Client.Protocol.fromUri(uri) orelse return error.DownloadFailed;
 
-    // For HTTPS with proxy, manually establish a CONNECT tunnel.
+    // For HTTPS through a proxy, manually establish a CONNECT tunnel.
     // Workaround for Zig's std.http.Client.connectProxied() returning 400.
-    if (protocol == .tls and proxy_url.len > 0) {
-        const proxy_info = proxy_tunnel.resolveProxy(allocator, environ_map, proxy_url);
+    // Checks both explicit proxy_url and environment variables (http_proxy, etc.).
+    if (protocol == .tls) {
+        const proxy_info = proxy_tunnel.resolveProxy(proxy_arena.allocator(), environ_map, proxy_url);
         if (proxy_info) |pi| {
             return downloadViaProxyTunnel(allocator, io, uri, pi.host, pi.port);
         }
     }
 
-    // No proxy — use client's built-in proxy support
-    initClientProxy(&client, allocator, environ_map, proxy_url);
+    var client: std.http.Client = .{ .allocator = allocator, .io = io };
+    defer client.deinit();
+    // No proxy for HTTPS, or plain HTTP — use client's built-in proxy support.
+    // Use proxy_arena for proxy allocations: std.http.Client.deinit() does not free
+    // proxy objects (they're externally-owned), so we manage their lifetime via the arena.
+    initClientProxy(&client, proxy_arena.allocator(), environ_map, proxy_url);
 
     var body_buf: [10 * 1024 * 1024]u8 = undefined;
     var body_writer: std.Io.Writer = .fixed(&body_buf);

src/network/mirror_probe.zig

@@ -178,12 +178,16 @@ fn probeThreadMainWindows(ctx: *ProbeThreadContext) void {
     const io = ctx.io orelse return;
     const environ_map = ctx.environ_map orelse return;
 
+    // Arena for proxy-related allocations: std.http.Client.deinit() does not free
+    // proxy objects (they're externally-owned), so we manage their lifetime via the arena.
+    var proxy_arena: std.heap.ArenaAllocator = .init(ctx.allocator);
     var client: std.http.Client = .{ .allocator = ctx.allocator, .io = io };
+    defer proxy_arena.deinit();
     defer client.deinit();
     if (ctx.proxy.len > 0) {
-        proxy_tunnel.setProxyFromUrl(&client, ctx.allocator, ctx.proxy) catch {};
+        proxy_tunnel.setProxyFromUrl(&client, proxy_arena.allocator(), ctx.proxy) catch {};
     } else {
-        client.initDefaultProxies(ctx.allocator, environ_map) catch {};
+        client.initDefaultProxies(proxy_arena.allocator(), environ_map) catch {};
     }
 
     const uri = std.Uri.parse(ctx.url) catch return;