Summary

• expand orchestration proxy coverage beyond the existing "not configured" checks
• add regression tests for non-proxy 404 behavior and unsupported-method rejection before any upstream fetch occurs
• add a tiny local fake upstream to verify that the proxy passes through upstream 409 status and JSON body correctly
• keep the slice focused on high-risk proxy behavior without introducing new shared fixture infrastructure

Validation

• zig build test -Dembed-ui=false -Dbuild-ui=false --summary all
• npm --prefix ui ci --no-audit --no-fund
• npm --prefix ui run build
• bash tests/test_e2e.sh
• zig fmt --check src/
• git diff --check

Notes

• this PR is test-only and does not change production proxy logic
• the local fake upstream is intentionally embedded in the test module to keep the slice small; if more HTTP-backed integration tests are added later, Phase 6 can factor it into broader shared helpers
• remaining Phase 5 slices are installer failure/cleanup coverage and service helper boundary coverage