feat(web-security): self-contained Flareprox IP rotation tool and skill

[GangGreenTemperTatum]

Summary

Adds a KISS, self-contained Flareprox integration to the web-security capability. No external flareprox repo/binary is required — the tool deploys Cloudflare Workers directly via the Cloudflare REST API.

Pending MrTurvey/flareprox#9 prior to merging (so can carry auth)

What's included

• capabilities/web-security/tools/flareprox.py — new Flareprox Toolset with:

  • flareprox_status — verify CF_API_TOKEN / CF_ACCOUNT_ID and count active workers
  • flareprox_create — deploy N Cloudflare Worker proxies
  • flareprox_list — list tracked workers
  • flareprox_proxy_url — round-robin worker URL for manual use
  • flareprox_request — send an HTTP request through a worker
  • flareprox_cleanup — delete all deployed workers

• capabilities/web-security/skills/ip-rotation/SKILL.md — agent skill with:

  • Activation gate on IPROTATE_ENABLED
  • When to use / when not to use
  • Prerequisites and lifecycle examples

• capabilities/web-security/agents/web-security.md — mention flareprox_* tools in the built-in tools list.

• capabilities/web-security/capability.yaml — bump version to 1.1.3, update description, add keywords.

• capabilities/web-security/tests/test_flareprox.py — mocked Cloudflare API tests.

• capabilities/web-security/tests/conftest.py — extend the Toolset test stub to support pydantic-like **kwargs construction and model_post_init, so field-bearing Toolset subclasses can be unit-tested.

Design notes

• Carries only the concept from the Claude Code harness (project-obsidian-md); no code or external dependency on ~/git/flareprox.
• Worker script is embedded in the Python file, so it works in hosted sandboxes.
• State persists to ~/.flareprox/workers.json.

Testing

python3 -m pytest capabilities/web-security/tests/test_flareprox.py -v

All 13 tests pass. The full web-security test suite (excluding test_bbscope.py which requires an optional bbscope module) also passes.

Deployment assumptions

• Cloudflare account with workers.dev enabled.
• CF_API_TOKEN with Workers Scripts edit permission.
• CF_ACCOUNT_ID set.