feat: remove proxyMode — all traffic goes through mcplocal proxy

proxyMode "direct" was a security hole (leaked secrets as plaintext env
vars in .mcp.json) and bypassed all mcplocal features (gating, audit,
RBAC, content pipeline, namespacing). Removed from schema, API, CLI,
and all tests. Old configs with proxyMode are accepted but silently
stripped via Zod .transform() for backward compatibility.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/db/prisma/migrations/20260307120000_remove_proxy_mode/migration.sql

@@ -0,0 +1,2 @@
+-- Remove proxyMode column (redundant — all traffic goes through mcplocal proxy)
+ALTER TABLE "Project" DROP COLUMN IF EXISTS "proxyMode";

src/db/prisma/schema.prisma

@@ -173,7 +173,6 @@ model Project {
   name        String   @unique
   description String   @default("")
   prompt      String   @default("")
-  proxyMode   String   @default("direct")
   proxyModel  String   @default("")
   gated       Boolean  @default(true)
   llmProvider     String?