feat: embed CLIProxyAPIPlus, eliminate vibeproxy dependency

[johannhipp]

What

Single binary with built-in provider auth. No vibeproxy needed.

Before: Amp CLI → amp-proxy → vibeproxy → CLIProxyAPIPlus → providers
After: Amp CLI → amp-proxy → providers

Changes

• Embed CLIProxyAPIPlus as in-process provider gateway on ephemeral loopback port
• CLI subcommands: amp-proxy login claude, amp-proxy status, amp-proxy serve
• Optional YAML config with ${ENV} expansion — model remaps, API keys, provider toggles, routing strategy
• Install script (bin/install.sh) — builds amp-proxy, downloads cli-proxy-api-plus, installs to ~/.local/bin
• cache_control stripping (was in vibeproxy ThinkingProxy layer)
• Default bind 127.0.0.1 (was 0.0.0.0)
• Reuses existing ~/.cli-proxy-api/ tokens from vibeproxy — zero migration effort

Quick start after merge

./bin/install.sh
amp-proxy login claude
amp-proxy

Files

File	Purpose
main.go	CLI subcommands: serve, login, logout, status, version
config.go	Optional YAML config with env expansion, sensible defaults
auth.go	Provider login/logout/status using ~/.cli-proxy-api/ tokens
gateway.go	Embeds CLIProxyAPIPlus via Builder/Service on ephemeral port
proxy.go	Main HTTP handler — routing, cache_control strip, Exa tools
remap.go	Model remapping now config-driven (was hard-coded)
bin/install.sh	macOS + Linux installer
config.example.yaml	Commented example config
ARCHITECTURE.md	Full architecture doc with decision rationale

Testing

• All 12 tests pass
• Live-tested on port 28317 (separate from running session on 18317)
• Verified: health, metrics, auth redirect, free-tier fake, model list via gateway, clean shutdown
• Existing vibeproxy tokens detected automatically