Feature/network proxy

[brzd-me]

Summary

Adds an optional Network proxy setting (http://host:port) that routes all SpotOn traffic to Spotify through an HTTP proxy. This covers the Web API, sign-in/token refresh, Web Player/Pathfinder, audio, and Spotify Connect. The main use case is servers in networks or regions where Spotify is not directly reachable.

With the field empty, behaviour is unchanged: the plugin builds exactly the same Slim::Networking::SimpleAsyncHTTP requests as before, and the binary is started without --proxy.

Why LMS's own "Web proxy" setting is not enough

Slim::Networking::Async::HTTP::use_proxy skips the server-wide webproxy for every https URL, and LMS has no HTTP CONNECT support. All Spotify endpoints are https, so the existing setting never applies.

Even if it did, it is server-wide: every plugin, radio stream and update check would go through the proxy. Often only Spotify needs a different route, while everything else should stay direct. A per-plugin setting covers that case.

The new setting is independent of webproxy: the plugin neither reads nor changes it.

Design

Perl side: Plugins::SpotOn::Net

• Plugins::SpotOn::Net->http(...) replaces every direct Slim::Networking::SimpleAsyncHTTP->new(...) in the plugin. A test guards against new direct uses.
• Without a proxy, it returns the stock SimpleAsyncHTTP.
• With a proxy, it returns a thin subclass whose Async::HTTP subclass does the following for https:
  1. connects to the proxy;
  2. sends CONNECT host:443;
  3. starts TLS with SNI through the tunnel (Net/Socket/HTTPSConnect.pm, modelled on LMS's own HTTPSSocks);
  4. forces skipDNS, so the proxy resolves Spotify hostnames.
• Plain http uses the standard absolute-URI proxying.
• Requests to localhost, 127.0.0.0/8 and ::1 (the daemon, LMS itself) always go direct.
• The handshake is blocking with one 5 s deadline, the same approach as LMS's built-in SOCKS support. After a timeout or connect failure, further attempts to that proxy fail fast for 30 s, so an unreachable proxy cannot repeatedly stall the main loop.
• Transport errors are reported to callers with a proxy: prefix, for example proxy: CONNECT rejected: 403 Forbidden.

Binary: librespot-spoton

• New --proxy <url> argument, applied via SessionConfig.proxy in all session modes (unified daemon, token-login, discover-once, authenticate, get-token). librespot then tunnels the AP connection, dealer websocket and its HTTP client.
• --check reports "proxy": true.
• Port 80 is rejected: the url crate drops the default port, and librespot's proxy socket has no default, so a port-80 proxy cannot work.

Fail-closed

• There is no automatic fallback to a direct connection.
• If a proxy is set and the selected binary does not report the proxy capability (for example an older custom binary), the daemon and the credential helpers are not started. A warning is shown in Settings and on the status page.
• Setting, changing or clearing the proxy restarts running daemons, including during playback, so no session keeps using the old route.

UI

• New field in Settings ‚Üí Global, with validation and a Test button. The button checks the typed value against apresolve.spotify.com without saving it.
• The status page and the diagnostic bundle show a "Network: direct / via proxy" line.
• New strings in all 11 languages.
• TROUBLESHOOTING.md has a "Using a proxy" section and README.md has a feature bullet.

Limitations (by design for this PR)

• HTTP CONNECT proxies only. SOCKS5 is not supported yet; most SOCKS clients (xray, sing-box, Clash) can also expose an HTTP port. The URL-with-scheme setting format leaves room to add socks5:// later.
• No proxy authentication. librespot's CONNECT tunnel does not send Proxy-Authorization.
• Cover images (i.scdn.co) are loaded by browsers, players and the LMS image proxy, not by the plugin, so they go direct. The existing Streaming Mode setting does not change this: it only affects how audio is relayed inside the LAN.
• The Perl transport subclasses LMS internals and was verified against LMS 9.x sources.

Testing

• Perl: prove t/ passes (27 files, 1269 tests) on Perl 5.36 and 5.38 (Linux containers with the same dependencies as perl-tests.yml) and on 5.34 (macOS).
  • New t/26_network_proxy.t covers URL parsing, the bypass rules, the CONNECT handshake against a forked fake proxy (200 on HTTP/1.0 and 1.1, 403/407/502, garbage, closed, silent/timeout), real TLS through the tunnel, redirects staying tunneled, the negative cache, and the guard against direct HTTP calls.
  • New t/27_proxy_daemon_restart.t covers daemon restart on proxy change and the fail-closed path.
  • t/09, t/13, t/16 and t/24 are extended.
• Rust: cargo test --locked passes (15 tests).
• Manual: tested on a Docker LMS (x86_64) through a real HTTP proxy. The Test button, browsing and playback all work through the proxy.

Notes for the maintainer

Thanks for SpotOn! It's a great)

• The binary must be rebuilt, so this needs a full release, not a Perl-only one.
• I left CHANGELOG.md untouched so you can word the entry yourself.
• build-librespot.yml didn't run cargo test, so the existing PassthroughMixer tests and the new --proxy tests never ran in CI. I added a single test step (x86_64 job only, before the build). It only runs on release tags and manual dispatch, not on PRs. Happy to drop it if you'd rather keep CI changes separate.
• The 10 non-English translations were not reviewed by native speakers.