fix: resolve security header profile persistence bug

- Add diagnostic logging to track security_header_profile_id conversions
- Replace silent failures with explicit HTTP 400 error responses
- Fix ProxyHostService.Update to properly handle nullable foreign keys
- Fix frontend dropdown to use explicit null checks (no falsy coercion)
- Add 7 comprehensive tests for profile assignment edge cases

Root cause: Backend handler had no else clause for type conversion failures,
causing old values to persist. Fixed by adding logging, error handling, and
changing service layer from Updates() to Select("*") for nullable FKs.

Refs: #<issue_number_if_applicable>

frontend/src/components/ProxyHostForm.tsx

@@ -617,7 +617,7 @@ export default function ProxyHostForm({ host, onSubmit, onCancel }: ProxyHostFor
             <select
               value={formData.security_header_profile_id || 0}
               onChange={e => {
-                const value = parseInt(e.target.value) || null
+                const value = e.target.value === "0" ? null : parseInt(e.target.value) || null
                 setFormData({ ...formData, security_header_profile_id: value })
               }}
               className="w-full bg-gray-900 border border-gray-700 rounded-lg px-4 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500"