fix[plugins](socai): added threatwinds provider specific (proxy) config

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Plugin bypasses standard auth/proxy flow to read local instance credentials directly, creating a new coupling and potential security risk.

• high plugins/soc-ai/config/config.go:240 — Plugin directly reads /updates/instance-config.yml, bypassing the centralized configuration management and introducing a hard dependency on local file system state.
• high plugins/soc-ai/config/config.go:246 — Hardcoded proxy URL path /proxy/api/ai/v1/chat/completions suggests a new contract dependency that may not be backwards compatible with existing proxy implementations.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Potential nil pointer dereference in readInstanceConfig error handling and internal jargon leakage in comments.

• high plugins/soc-ai/config/config.go:243 — Potential nil pointer dereference: if readInstanceConfig returns an error, 'ic' is nil. Accessing 'ic.Server', 'ic.InstanceID', or 'ic.InstanceKey' in the conditional will cause a panic.
• medium plugins/soc-ai/config/config.go:238 — Internal jargon 'ponytail' leaked into source code comments.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Hardcoded credentials/proxy logic introduced in threatwinds provider; touches security-critical auth path.

• high plugins/soc-ai/config/config.go:262 — The implementation introduces a hardcoded path to /updates/instance-config.yml and bypasses user-provided API keys in favor of instance-level credentials. This modifies the authentication flow for the threatwinds provider and relies on static file-based secrets, which is a security-critical change.
• medium plugins/soc-ai/config/config.go:275 — Internal identifier 'ponytail' leaked in code comments. Internal project names or handles must not be exposed in source code.

🔴 go-deps — pending updates

🔍 Discovered 27 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.289.0 → v0.290.0

  📁 ./backend:
     - google.golang.org/api: v0.289.0 → v0.290.0

❌ Please update dependencies before merging.