feat(proxy): stream MITM bodies into durable capture files

[M09Ic]

Summary

• unify curl and MITM HTTP observations through aop/traffic.Exchange
• stream request/response bodies to file-backed sinks with bounded previews and on-demand hydration
• cover buffered and streaming MITM lifecycle hooks, including failures and stream termination
• make FlowStore metadata reloadable and subscriber delivery cursor-based so slow consumers do not silently drop flows
• apply capture filters before persistence and preserve the Runner↔Cairn WebSocket transport

Verification

• go test ./...
• go test -race ./tools/proxy
• git diff --check

Existing untracked scan outputs in the workspace were intentionally left untouched.