Honor no_proxy / NO_PROXY for proxied outbound requests (widget manifest, etc.)

Describe the problem to be solved

When an outbound HTTP proxy is configured (HTTPS_PROXY / https_proxy for trusted requests, GRIST_PROXY_FOR_UNTRUSTED_URLS for untrusted ones), Grist routes every request through that proxy. There is currently no way to exclude specific hosts from proxying.

GristProxyAgent (app/server/lib/ProxyAgent.ts) deliberately overrides getProxyForUrl to always return the configured proxy URL, short-circuiting proxy-from-env. As a result the standard no_proxy / NO_PROXY environment variable is ignored.

This is a problem in corporate setups where the proxy is only meant for external traffic and internal hosts must be reached directly. One concrete case is the agent that fetches the custom widget manifest (WidgetRepository.ts, using agents.trusted): if the widget list URL points to an internal host, the request is still forced through the proxy and fails.

This is the no_proxy part of #855, scoped down to something actionable.

Describe the solution you would like

Honor the standard no_proxy / NO_PROXY environment variable in GristProxyAgent, using the usual semantics:

• comma/space separated list of host suffixes
• * disables proxying entirely
• optional :port component
• leading-dot and bare-domain suffix matching (.example.com / example.com)

Applied to both the trusted and untrusted proxy agents. When a request URL matches the bypass list, the connection is made directly instead of through the proxy.