[Ingest] Route scraping through an optional V2Ray/Xray proxy (Telegram in Iran)

Telegram and some sources are filtered in Iran. .NET cannot speak vmess/vless/trojan, so add an Xray sidecar (compose service 'xray', behind the 'proxy' profile) that converts the admin's config into a local SOCKS5 proxy (xray:10808). New ScrapeHttpClients provider builds a proxied or direct HttpClient (WebProxy supports socks5/socks4/http) cached per proxy URL; all five ingestion sources (Telegram/Bale/Divar/Medjobs/Websites) now use it. Admin settings gain IngestProxyEnabled + IngestProxyUrl (migration; UI under sources). Added deploy/xray/config.json template + README with vmess/vless/trojan examples.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -29,6 +29,19 @@ services:
     # healthcheck is defined in the Dockerfile (bash /dev/tcp probe) so the deploy
     # job's `docker inspect Health.Status` wait works.
 
+  # ── Xray/V2Ray client — converts a vmess/vless/trojan config into a local SOCKS proxy ──
+  # so ingestion can reach Telegram etc. from inside Iran. Behind the "proxy" profile, so it
+  # only runs when you opt in: `docker compose --profile proxy up -d xray`. Put YOUR config at
+  # deploy/xray/config.json (see deploy/xray/README.md), then in /Admin/Settings set the
+  # ingestion proxy to socks5://xray:10808. Not published — only the app reaches it.
+  xray:
+    image: mirror.soroushasadi.com/teddysun/xray:latest
+    container_name: hamkadr_xray
+    restart: unless-stopped
+    profiles: ["proxy"]
+    volumes:
+      - ./deploy/xray/config.json:/etc/xray/config.json:ro
+
   # ── PostgreSQL (internal only — never published) ─────────────────────────────
   db:
     image: mirror.soroushasadi.com/postgres:16-alpine