ops(proxy): verify and codify OVH46 source-IP-isolated SOCKS5H egress

[AlexJJ009]

Context

OVH46 already runs TokenRouter as a container image and has a systemd-managed sing-box local multi-IP egress service. This issue does not migrate a TokenRouter source checkout and does not add a hysteria2:// scheme.

Scope

Verify and codify the deployment contract for the existing local SOCKS5H egress listeners that bind TokenRouter accounts, through the existing proxy_id abstraction, to selected OVH46 public source IPs.

Requirements

• Keep TokenRouter proxy schemes limited to http, https, socks5, and socks5h.
• Record the actual container-reachable listener address, Docker network, systemd unit, sing-box configuration ownership, restart sequence, and rollback sequence.
• Verify at least two account-bound listeners expose two different configured OVH46 public source IPs.
• A failed assigned proxy must not silently fall back to direct egress.
• Preserve existing proxy health checks, connection-pool isolation, scheduling, and billing behavior.
• Do not include HY2 user-subscription aggregation or unified HY2 traffic accounting.

Security gate

The current OVH46 Compose file publishes PostgreSQL on a public address. Before delivery, inventory callers, take and verify a backup, validate OVH109/other dependencies, then replace ordinary public exposure with a vRack-private binding or an equivalent explicit source-address allowlist.

Acceptance

• A test account completes health check and representative OAuth/usage/API requests through its assigned listener.
• Failure of the assigned listener produces a diagnosable proxy error and never direct-connects.
• The database is no longer reachable from ordinary public source addresses; any required cross-host access is explicitly allowlisted and verified.
• Secrets and proxy credentials are absent from ordinary logs and documentation examples.

[smartcmd]

PR is welcomed