feat: consolidate proxy config into structured section and add support for custom commands to skip proxy (#240)

* feat: add ProxyConfig struct with per-PM skip_commands and legacy fallback

* feat: consolidate proxy config into structured section with backward compat

Replaces flat proxy_mode/proxy_install_only keys with a structured proxy
section supporting per-package-manager skip_commands. Legacy keys are
respected via fallback when user's config lacks the new proxy section.
Removes deprecated experimental_proxy_mode config and flag.

* fix: env var resolution for nested config keys and deduplicate skip command matching

- Add "." to "_" in Viper env key replacer so nested keys like
  sandbox.enabled resolve from PMG_SANDBOX_ENABLED (was silently broken)
- Export IsFirstNonFlagArgInList and remove duplicate from proxy_flow.go
- Add table-driven tests for skip command matching with real-world cases
- Remove redundant env var test

* docs: update proxy configuration and env var documentation

Update config.md env var table to reflect new proxy.enabled and
proxy.install_only keys. Add proxy configuration section to proxy.md
covering config structure, per-PM skip commands, CLI flags, and env vars.

* fix: legacy fallback precedence

config/config.template.yml

@@ -32,18 +32,27 @@ skip_event_logging: false
 # This is the number of days to retain event logs.
 event_log_retention_days: 7
 
-# Proxy mode. Default is true.
+# Proxy configuration.
 # When enabled, PMG uses a proxy-based interception approach instead of the
 # default guard-based analysis. The proxy intercepts package manager requests in real-time
 # and analyzes packages as they are downloaded. Proxy mode may not work in all environments,
 # and can be disabled to fall back to the guard-based analysis.
-proxy_mode: true
+proxy:
+  enabled: true
 
-# Restrict proxy to install commands only. Default is false.
-# When false, the proxy intercepts all package manager commands (e.g., npm install, npm ls).
-# When true, non-install commands bypass the proxy and execute directly, which can improve
-# performance for commands that don't download packages (e.g., npm ls, pip list, npm outdated).
-proxy_install_only: false
+  # When true, only install commands are proxied. Other commands
+  # (e.g., npm ls, pip list) bypass the proxy and execute directly.
+  install_only: false
+
+  # Per-package-manager proxy policies.
+  # Additional commands to bypass the proxy.
+  # Example:
+  #   policies:
+  #     pip:
+  #       skip_commands: ["list", "show"]
+  policies:
+    npm:
+      skip_commands: []
 
 # Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
 # This is useful for packages that are known to be safe and are used in the application.