fix(linux): relay bind, config perms, GUI update security

[1rhino2]

Summary

Three Linux security fixes:

1. Relay bind: TCP/UDP relay ports 34010 and 34011 used INADDR_ANY. Now 127.0.0.1 only, same idea as the other platforms.

2. Config perms: proxy creds in /etc/proxybridge/config.ini were default world readable. Dir 0700, file 0600, chmod on load for old installs.

3. GUI update: used to curl deploy.sh from raw github and run bash as root. Now just hits the releases API and opens the release page in the browser.

Test plan

• build linux gui + core on ubuntu/debian
• ss -lntp shows 127.0.0.1:34010 and :34011 only
• save settings, stat -c %a /etc/proxybridge/config.ini is 600
• About -> Check for Updates opens github, no deploy.sh exec

Happy to open a tracking issue first if you want that before merge.

[Anof-cyber]

Can you create pull. Also when you say open GitHub for check update is it opening browser?

The mac and windows version use https://download.interceptsuite.com/proxybridge.json
To check for new update.

GitHub release is not predictable as new release might be for specific OS only.

[1rhino2]

ye - opened the PR: #212

and ye, check for updates opens the system browser (gtk_show_uri_on_window). it does not download or run anything.

also switched linux off github releases/latest onto the same feed as mac/windows:

https://download.interceptsuite.com/proxybridge.json

reads the linux entry only, compares versions, then opens release_notes (fallback download) in the browser. no more deploy.sh curl|bash.