feat(14-01): record vendor calls with summer parity:upstream and replay them offline

- WriteUpstream masks vars, hashes long base64 JSON strings and refuses unmasked Authorization/X-Api-Key
- multipart requests recorded as ordered parts; the fake compares parts and hashed payloads
- loopback CONNECT recording proxy with a local ECDSA parity CA, script and forward modes
- parity:upstream command, README and parity docs

cmd/summer/main.go

@@ -39,6 +39,7 @@ func toolCommands() []bonfire.Command {
 		parityRecordCommand(),
 		parityReplayCommand(),
 		parityBroadcastsCommand(),
+		parityUpstreamCommand(),
 		delegateCommand("migrate", "Run plugin migrations in the app binary"),
 		delegateRollbackCommand(),
 		delegateCommand("migrate:status", "Show per-plugin migration history in the app binary"),