fix: credential TCP precheck bypass proxy and pipeline goroutine leak

- Skip TCP precheck when proxy is enabled, net.DialTimeout cannot
  reach targets behind SOCKS5/HTTP proxy
- Drain stream channel on ctx cancellation to prevent EnhancedPortScan
  goroutine from blocking on a full channel

core/service_scanner.go

@@ -175,10 +175,15 @@ func (s *ServiceScanStrategy) performHostScan(ctx context.Context, session *comm
 
 	// pipeline 消费：边收开放端口边执行插件
 	pluginsToRun, isCustomMode := s.GetPlugins(config)
+	cancelled := false
 	for addr := range stream {
+		if cancelled {
+			continue // ctx 已取消，排空 stream 防止写端阻塞
+		}
 		select {
 		case <-ctx.Done():
-			return
+			cancelled = true
+			continue
 		default:
 		}
 

plugins/services/credential_tester.go

@@ -152,7 +152,8 @@ func TestCredentialsConcurrently(
 	}
 
 	// TCP 预检：快速验证目标可达，避免对不可达目标浪费全部凭据尝试
-	if testConfig.TargetAddr != "" {
+	// 代理模式下跳过：net.DialTimeout 直连无法到达代理后的内网目标
+	if testConfig.TargetAddr != "" && !common.IsProxyEnabled() {
 		preConn, err := net.DialTimeout("tcp", testConfig.TargetAddr, 3*time.Second)
 		if err != nil {
 			return &ScanResult{