SSH's async SOCKS5 and HTTP CONNECT code moves to clients::proxy as a blocking dialer (SSH runs it on a blocking thread), so RDP and others can use the same implementation. The proxy handshake now has a read timeout, and new tests drive both proxy types against fake proxies, including SOCKS5 username/password auth and a refused HTTP CONNECT (407).