[FEATURE] Claude Code on the web: allow non-HTTPS TCP egress (e.g. Postgres 5432) when Network access = Full

In a cloud session with Network access set to Full, outbound connections only work over HTTPS on port 443 through the agent proxy. Direct TCP to any other port fails for every host:

• a managed Postgres pooler on 5432 and 6543
• portquiz.net:5432 and :8080
• github.com:22

DNS resolves fine, and the same pooler host on 443 connects. The container's /root/.ccr/README.md lists "raw-TCP databases" as unsupported through the proxy.

This blocks read-only database diagnostics (psql against a read replica), which work in local sessions.

Request: when access is Full, allow direct TCP egress, or allowlist host:port pairs per environment (the cloud counterpart of #96169).

Related: #34690