Configure explicit proxy profiles, titles and knock hosts

[andre487]

Proxy profiles now come from explicit inventory settings, so enabling SSH on a host no longer creates every possible direct or jump profile.

• Add opt-in SSH direct profiles via generate_profile, explicit ssh_jump_pairs and https_jump_pairs, and keep server-side https_chain_pairs separate. SSH jumps use the same global account on both hops; subscriptions include only linked accounts.
• Require nonblank titles for HTTPS/SSH services and all pairs. Read titles directly from inventory, preserve stable profile IDs, and order direct HTTPS, direct SSH, HTTPS chains, HTTPS jumps, then SSH jumps.
• Ask for a knock host when the setup wizard enables probe resistance. Export the existing probe_resistance.knock setting as browser.knockHost for HTTPS routes; omit it for MASQUE.
• Update documentation, examples and regression checks.

Validation: ./mega-proxy check passes (129 tests, Ruff, compilation and Ansible syntax checks). Current inventory and all four examples validate. Deployed to nine HTTPS proxy hosts and both config APIs; all 14 HTTPS routes return the expected authentication challenge for the configured knock host, and both APIs return identical ordered profiles with knock metadata.