T5DE's local proxy for IMVU Classic

The client sends it every HTTP request and its IMQ connection; it makes them with current TLS and
certificates, upgrades IMVU's plain-HTTP hosts to HTTPS, and refuses IMVU's reporting endpoints. CI
tests it and publishes t5de-proxy.exe as nightlies and tagged releases.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -0,0 +1,26 @@
+# t5de-proxy
+
+T5DE's local proxy for IMVU Classic (see README.md, docs/hosts.md). Part of T5DE; the patches and the patcher are
+in the `t5de` repository (git.t5de.dev/t5de/t5de, usually checked out beside this one). The client side is t5de's
+`t5de-proxy` patch (`main/client.py` `t5deProxy*`, `Network.urlopen`/`post_multipart`,
+`IMQConnection.__buildStrategies`). A later goal is a backend of T5DE's own behind it.
+
+## Rules
+
+- Never commit IMVU's code: no decompiled source, no captured traffic with account data. Our own declarations of
+  IMVU's protocols (message type numbers, framing) and notes in our own words are fine.
+- Test with a throwaway IMVU account, never a real one.
+- Commits: author "dhkatz <dev@t5de.dev>"; never the user's real name or email.
+- The user rejects designs that delay what's shown: the proxy streams responses and adds no waiting.
+
+## Notes
+
+- The client's Python (2.7, OpenSSL 1.1.0f, TLS 1.2 only, `resources/cacert.pem` from IMVU) makes every HTTP
+  request in `Network.urlopen`, including the embedded browser's: Gecko 1.9.2's http/https protocol handlers are
+  replaced by IMVU's `PythonProtocolHandler` (imvugecko.dll), which calls `Network.performGeckoRequest`. No IMVU
+  native code makes HTTP requests (Flash and `IMVUQualityAgent.exe` aside).
+- The log leaves out queries unless tracing (`-trace`, `T5DE_PROXY_TRACE=1` in the client's environment): they
+  can hold session values. Never log headers or bodies.
+- t5de's `tools/drive.py` starts the built client, takes screenshots, clicks, and sends `imvu:` commands
+  (`showMode?mode=shop`, ...), so the proxy can be tested in the real client without a person; the test
+  account's saved login signs in by itself. The log is `%TEMP%\t5de-proxy.log`.