feat(libhttp,gateway): add admin-only WebSocket reverse proxy

libhttp v3.1:
- add ws_proxy(path, handshake) API with WsProxyHandshakeHandler callback
- implement full-duplex async bidirectional bridging (text+binary frames)
- support ws:// and wss:// backends with SNI, write queues for ordering
- proxy routes take priority over regular ws() routes
- 403 response on handshake rejection, graceful close propagation

gateway v0.6.0:
- add [WsProxy] config section (routes = /path=ws://backend;...)
- handshake callback verifies Token (Authorization/Cookie) is_admin=true
- non-admin / expired / missing token → 403, admin → transparent bridge
- fix LocalTime.hpp C++20 tzdb incompatibility on Apple clang (use strftime/get_time/mktime)
- update example.ini and README docs for both modules

gateway/example.ini

@@ -32,3 +32,12 @@ allowed_origins = https://qsont.me;https://www.qsont.me;http://127.0.0.1:8443;ht
 
 [Database]
 path = sqlite3.db
+
+[WsProxy]
+# WebSocket 反向代理路由（仅管理员可访问）
+# 格式：routes = /path=ws://host:port/target;/path2=ws://host2:port2/target2
+# 握手阶段会校验 HTTP Upgrade 请求中的 Token（Authorization: Bearer xxx 或 Cookie: q4_token=xxx），
+# 仅 Token 中 is_admin=true 的用户才能升级连接；非管理员或无 Token 直接拒绝。
+# 支持 ws:// 和 wss:// 后端
+# 示例：routes = /ws/aibox=ws://127.0.0.1:8765;/ws/other=wss://example.com/ws
+routes =