Cover default web proxy composition and real UDP fallback

[cppla]

Summary

Add one integration test for the complete default web-auto proxy path, reusing the existing byte-validating frontend exercises:

• SOCKS5 CONNECT, HTTP absolute-form forwarding and HTTP CONNECT through a real dual-protocol web relay, asserting H3 selection after every exchange.
• The same frontend exercises through an H2-only relay plus a same-port UDP blackhole, asserting that real UDP packets were attempted and H2 was selected. Cover both supported Chrome fallback configurations.
• Bounded listener/connection cleanup with joined serving goroutines.

This closes a composition-coverage gap; it is not a production bug fix. No production source, configuration default, dependency, release metadata or comparison gate changes.

Validation

• Go 1.27.2 offline make check passed.
• New TestWebProxyComposition: host race detection, three repeats, passed.
• New test compiled for linux/arm64: three repeats passed in a non-root, read-only, network-none Docker container using real loopback sockets.
• Eighteen existing web lifecycle/resumption/UDP test groups passed three repeats in the same constrained Linux container setup.
• Existing Docker CLI integration smoke passed on the unchanged production source: init, offline checks, native QUIC/TLS, auto fallback, doctor, wrong-token rejection, and verified owned-resource cleanup.
• Independent source review found no blocker.

Acceptance is scoped to practical self-use stability, as requested. No large capture campaign, passive-similarity claim or new release is included.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.