fix(control-plane): wire ProxyFromEnvironment into default HTTP transport

installServiceCAIntoDefaultTransport replaced http.DefaultTransport with a
bare &http.Transport{TLSClientConfig: ...} that had no Proxy field set.
Go's net/http silently ignores HTTPS_PROXY/HTTP_PROXY env vars when the
transport's Proxy field is nil, causing all outbound connections to go
direct instead of through the cluster egress proxy.

This manifested as the OIDC token fetch to sso.redhat.com timing out after
~9 minutes (raw TCP connect timeout) despite the proxy env vars being
present on the pod.

Fix: set Proxy: http.ProxyFromEnvironment and restore the standard
DefaultTransport dialer/timeout fields that the bare struct initializer
was silently zeroing out.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Ambient Code Bot

components/ambient-control-plane/cmd/ambient-control-plane/main.go

@@ -5,10 +5,12 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
+	"time"
 
 	"github.com/ambient-code/platform/components/ambient-control-plane/internal/auth"
 	"github.com/ambient-code/platform/components/ambient-control-plane/internal/config"
@@ -216,6 +218,13 @@ func loadServiceCAPool() *x509.CertPool {
 
 func installServiceCAIntoDefaultTransport(pool *x509.CertPool) {
 	http.DefaultTransport = &http.Transport{
+		Proxy:                 http.ProxyFromEnvironment,
+		DialContext:           (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
 		TLSClientConfig: &tls.Config{
 			MinVersion: tls.VersionTLS12,
 			RootCAs:    pool,