Save-as-final-hop button, browser proxy policy + QUIC kill, HTTPS tunnel probe

Fixes 'exit proxy never used in chain' and 'browsers break when chain is green'. Chain Builder gets a Save-as-final-hop button that appends the typed exit proxy to the manual chain. On engage, Chromium browsers get pinned to our proxy via HKLM policy (ProxyMode=fixed_servers, ProxyServer, ProxyBypassList) and QuicAllowed=0 so HTTP/3 doesn't bypass HTTP proxies and stall under the kill-switch. Chain start now runs check_https_tunnel and warns clearly when proxies forward HTTP but refuse CONNECT — the real cause of green-chain-yet-blank-browser.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_proxy_god.py

@@ -18,6 +18,7 @@ from proxy_chain_manager.config import (
 from proxy_chain_manager.fetcher import fetch_proxy_json, normalize_entries
 from proxy_chain_manager.validator import (
     check_chain_exit_ip,
+    check_https_tunnel,
     get_direct_ip,
     validate_proxies,
 )
@@ -206,6 +207,14 @@ class TestValidator(unittest.TestCase):
             self.skipTest("could not reach ipify (offline or blocked)")
         self.assertGreater(len(ip), 4)
 
+    def test_check_https_tunnel_invalid_proxy_quick(self) -> None:
+        async def run() -> tuple[bool, str]:
+            return await check_https_tunnel("http://127.0.0.1:1", timeout_seconds=4.0)
+
+        ok, msg = asyncio.run(run())
+        self.assertFalse(ok)
+        self.assertTrue(msg)
+
     def test_check_chain_exit_ip_invalid_proxy_quick(self) -> None:
         async def run() -> str | None:
             return await check_chain_exit_ip(