fix: route LLMaaS health probes through proxy

[aelttil]

Summary

• adapt /health and system_health LLMaaS probes to use PROXY_URL when configured
• reuse the same explicit httpx.AsyncClient(proxy=...) pattern already used by ConsolidatorService
• keep the consolidator behavior unchanged
• add proxy coverage for both HTTP health and MCP system_health

Tests

• uv run pytest tests/test_proxy.py -q
• uv run pytest -q

[chrlesur]

Review

Verdict: APPROVE — this fixes a real health-check blind spot: in a proxied environment, the LLMaaS probes went out direct while every real LLM call goes through PROXY_URL, so /health and system_health could report a path that production traffic never takes (false negative — or worse, false positive when only the direct route works).

Checks performed

• Full suite on the PR branch: 415 passed + 1 xfailed (baseline 413 + the 2 new tests).
• Pattern is strictly aligned with ConsolidatorService (explicit httpx.AsyncClient(proxy=...) injected as http_client); the explicitly created proxy client is closed in finally — no leak on that path.
• models.list() result is consumed via .data only (already loaded), so reading it after aclose() is safe — no lazy pagination after close.
• Error sanitization on the public /health endpoint: already covered by the pre-existing LM2-24 handler (generic "LLMaaS unreachable", details logged server-side only) which wraps this change — no proxy URL/credential can leak in the response. A malformed PROXY_URL is additionally rejected at startup by config validation.
• No-proxy behavior unchanged (http_client=None → SDK-managed client).
• The two tests assert the meaningful contract: proxy kwarg + timeout, http_client handed to AsyncOpenAI, aclose awaited, final status.

Optional (no change requested)

1. This is now the third copy of the proxy+AsyncOpenAI construction pattern (middleware, system tool, consolidator) — a small shared helper would be a nice future factorization, also the right place for an exception-safe close.
2. Public /health triggers one LLMaaS hit per request; bounded by the global rate limit today. A short-TTL cache would be a future improvement if monitoring traffic ever makes this noisy.