Send the controller secret when TrafficStore polls /connections

[madeye]

Problem

The Traffic & Data tab read "Zero KB" and "0 proxy / 0 total" while the engine was moving tens of megabytes. Querying the controller directly showed it healthy the whole time:

downloadTotal = 68509403
uploadTotal   = 743294
connections   = 15

AppConstants.authorizedControllerRequest exists so every REST client attaches Authorization: Bearer <secret> uniformly, and its doc comment says as much. TrafficStore.fetchConnections was the sole call site that passed a bare URL instead — nine others route through the helper.

The main app always generates a controller secret, so every poll came back 401. The response body has no connections key, so the guard fell through to a silent return and the counters never left zero.

$ curl -o /dev/null -w '%{http_code}' http://127.0.0.1:<port>/connections
401
$ curl -o /dev/null -w '%{http_code}' -H 'Authorization: Bearer <secret>' ...
200

Fix

Route the poll through the helper, and log a non-200 instead of discarding it silently so the next auth or address regression is visible rather than presenting as "everything is zero".

Why no test caught it

ProxyEngineHelper.start passed "" as the controller secret, so the entire integration suite exercised an open controller and structurally could not catch a REST client that forgets the header.

It now takes an optional controllerSecret (defaulting to "", so existing callers are untouched), and three tests close the gap:

• a secret-protected controller refuses a bare request (401)
• authorizedControllerRequest is accepted (200)
• TrafficStore's own polling reports non-zero bytes end to end

That last one guards the call site rather than just the contract: removing the header makes it fail with downloaded → 0, reproducing the reported symptom exactly.

Full suite (216) green, swiftlint --strict clean.