docs: add API Proxy section to CLI reference

[Mossaka]

Summary

The CLI reference is missing the entire API Proxy section — 10 flags representing a major feature with zero documentation.

Missing flags

Flag	Description
--enable-api-proxy	Enable API proxy sidecar for secure credential injection
--copilot-api-target <host>	Target hostname for Copilot API (default: api.githubcopilot.com)
--openai-api-target <host>	Target hostname for OpenAI API (default: api.openai.com)
--openai-api-base-path <path>	Base path prefix for OpenAI API requests (e.g. /serving-endpoints for Databricks)
--anthropic-api-target <host>	Target hostname for Anthropic API (default: api.anthropic.com)
--anthropic-api-base-path <path>	Base path prefix for Anthropic API requests
--rate-limit-rpm <n>	Max requests/minute per provider (default: 600)
--rate-limit-rph <n>	Max requests/hour per provider (default: 10000)
--rate-limit-bytes-pm <n>	Max request bytes/minute per provider (default: ~50MB)
--no-rate-limit	Disable rate limiting in API proxy

Additional context

The API proxy sidecar (containers/api-proxy/, IP 172.30.0.30) injects real API credentials that the agent never sees. Ports: 10000 (OpenAI), 10001 (Anthropic), 10002 (Copilot), 10004 (OpenCode). This is a security-critical feature that users need documentation for.