Cover HTTPS access from worker networks

[vitormattos]

Summary

Add integration coverage for accessing the shared HTTPS proxy from a worker container through the worker's canonical hostname.

Why

LibreSign's Dev Container integration exposed a gap in the proxy test suite: host-loopback HTTPS was covered, but worker-network HTTPS was not.

The regression test now verifies both TCP ports 80/443 and a real HTTPS request through:

worker container
  -> <worker>.localhost
  -> shared proxy
  -> backend

The test confirmed that the current proxy implementation supports this path. The failure observed in LibreSign came from starting its optional Playwright runner and probing the proxy immediately; LibreSign now starts the runner explicitly and waits/retries through a real Chromium smoke test.

This PR therefore adds the missing NCDD regression coverage without changing runtime behavior.