Save-as-final-hop button, browser proxy policy + QUIC kill, HTTPS tunnel probe

Fixes 'exit proxy never used in chain' and 'browsers break when chain is green'. Chain Builder gets a Save-as-final-hop button that appends the typed exit proxy to the manual chain. On engage, Chromium browsers get pinned to our proxy via HKLM policy (ProxyMode=fixed_servers, ProxyServer, ProxyBypassList) and QuicAllowed=0 so HTTP/3 doesn't bypass HTTP proxies and stall under the kill-switch. Chain start now runs check_https_tunnel and warns clearly when proxies forward HTTP but refuse CONNECT — the real cause of green-chain-yet-blank-browser.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/app.py

@@ -660,10 +660,34 @@ def main() -> None:
                          fg_color=ACCENT2, hover_color=ACCENT)
     test_exit_btn.pack(side="left")
 
+    def _save_exit_to_chain() -> None:
+        """Append the typed exit proxy to the manual chain as the final hop."""
+        url = _exit_url()
+        if not url:
+            _log("Exit node: paste a host:port[:user:pass] first.")
+            return
+        # If the URL is already in the chain, move it to the bottom rather than dup.
+        if url in manual_chain:
+            manual_chain.remove(url)
+        manual_chain.append(url)
+        hop_status[url] = "ok" if (
+            exit_test_dot.cget("text_color") == GREEN
+        ) else "untested"
+        use_manual_var.set(True)
+        _rebuild_chain_ui()
+        exit_proxy_entry.delete(0, "end")
+        exit_user_entry.delete(0, "end")
+        exit_pass_entry.delete(0, "end")
+        exit_test_dot.configure(text_color=RED)
+        _log(f"Exit node added as final hop ({len(manual_chain)} total).")
+
+    _btn(exit_btn_row, "Save as final hop", _save_exit_to_chain, w=140, h=26,
+         fg_color=GREEN, hover_color="#00b377").pack(side="left", padx=(6, 0))
+
     ctk.CTkLabel(
         exit_fix_frame,
         text=(
-            "Appended after your chain hops. Leave empty to use last chain hop as exit.\n"
+            "Test exit, then 'Save as final hop' appends it to YOUR CHAIN above as the last proxy.\n"
             "Paste any of:  host:port:user:pass  •  user:pass@host:port  •  scheme://host:port\n"
             "No scheme = SOCKS5. Paste auto-splits into User/Pass below."
         ),