feat: add Tor SOCKS5 proxy support for outbound .onion connections

[sat-engineer]

Summary

• Implement SOCKS5 protocol in connection.rs to route outbound peer connections through a Tor proxy, enabling LDK nodes to connect to peers at .onion addresses
• Add set_tor_proxy_address() on NodeBuilder with FFI-compatible UDL bindings
• Route OnionV3 addresses through SOCKS5 proxy while keeping clearnet addresses on direct TCP

Details

This is a self-contained SOCKS5 implementation (~100 lines) that doesn't depend on unreleased upstream code. It follows the approach of ldk-node #778 but avoids the dependency on lightning_net_tokio::tor_connect_outbound() which isn't in any released crate version yet.

SOCKS5 features:

• Full RFC 1928/1929 handshake (method negotiation, username/password auth, CONNECT)
• Tor stream isolation via random password per connection (uses EntropySource::get_secure_random_bytes())
• Supports OnionV3, IPv4, IPv6, and Hostname address types
• Base32 encoder for OnionV3 address derivation
• 30-second connection timeout

Architecture:

• tor_proxy_address lives on NodeBuilder (not Config) for UniFFI compatibility
• ConnectionManager detects .onion addresses and routes them through the proxy
• No new crate dependencies

Test plan

• cargo check passes with zero warnings
• Built and deployed on Umbrel with two Alby Hub instances
• Peer connection over .onion succeeded
• Lightning channel opened over Tor
• Lightning payments settled over Tor (1k and 2k sats, 0 fees)

🤖 Generated with Claude Code

[sat-engineer]

Author issue