fix(rpc): bypass the env proxy for loopback RPC and local stats

Loopback HTTP was still subject to the process environment's proxy
settings (http_proxy / all_proxy). That routed the local daemon's
basic-auth credentials and wallet data - and the miner's 127.0.0.1
stats API - through whatever proxy the user's shell happened to
export, and could break the connection outright.

- Local daemon RPC now sets curl's no-proxy to "*" when the host is
  loopback, so it always connects directly. This also overrides a
  no_proxy list. Remote daemons keep full proxy support unchanged.
- The xmrig stats fetch against the local miner API does the same.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/daemon/xmrig_manager.cpp

@@ -739,6 +739,7 @@ void XmrigManager::fetchStatsHttp() {
     headers = curl_slist_append(headers, authHeader.c_str());
 
     curl_easy_setopt(curl, CURLOPT_URL, url);
+    curl_easy_setopt(curl, CURLOPT_NOPROXY, "*");   // 127.0.0.1 miner API: never via an env proxy
     curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curlWriteCb);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseData);

src/rpc/rpc_client.cpp

@@ -225,6 +225,10 @@ bool RPCClient::open(const std::string& host, const std::string& port,
     // budget for the TCP + TLS handshake over real network latency (1s would spuriously fail).
     const long connectTimeout = Connection::isLocalHost(host) ? 2L : 10L;
     curl_easy_setopt(impl_->curl, CURLOPT_CONNECTTIMEOUT, connectTimeout);
+    // Loopback RPC carries basic-auth creds + wallet data: never route it through an env proxy
+    // (http_proxy / all_proxy). Remote daemons keep proxy support. NOPROXY also overrides no_proxy.
+    if (Connection::isLocalHost(host))
+        curl_easy_setopt(impl_->curl, CURLOPT_NOPROXY, "*");
     // Enforce TLS certificate + hostname verification explicitly rather than relying on libcurl's
     // build defaults. Harmless on the localhost http:// case; essential for a remote https daemon.
     curl_easy_setopt(impl_->curl, CURLOPT_SSL_VERIFYPEER, 1L);