feat(03b): add BYO custom proxy provider + bounded crawler rotation-retry

Add CustomProxyProvider (single endpoint or rotating pool via Scrapling ProxyRotator), registered as 'custom' alongside anonymous_proxies and selectable via PROXY_PROVIDER. Adds is_pool_backed to the ProxyProvider ABC + a zero-arg package helper. The web crawler does a bounded one-per-tier is_proxy_error rotation-retry gated on is_pool_backed() (single-endpoint providers no-op). Config/.env.example gain CUSTOM_PROXY_URL(S). Zero-arg getter contract unchanged for all consumers. Documents the proprietary boundary test (generic proxy infra stays Apache-2). Tests: provider, registry, crawler rotation (16).

Co-authored-by: Cursor <cursoragent@cursor.com>

surfsense_backend/app/utils/proxy/base.py

@@ -44,3 +44,15 @@ class ProxyProvider(ABC):
         if proxy_url is None:
             return None
         return {"http": proxy_url, "https": proxy_url}
+
+    @property
+    def is_pool_backed(self) -> bool:
+        """Whether this provider rotates across a *client-side* pool of endpoints.
+
+        ``False`` for single-endpoint providers (including server-side rotating
+        gateways like ``anonymous_proxies``, whose rotation happens upstream).
+        The crawler performs its bounded proxy-error rotation-retry **only** when
+        this is ``True`` — retrying a single static endpoint would just re-hit the
+        same dead proxy.
+        """
+        return False