I believe having AEM publisher as proxy is possible but not ideal as it is very expensive. We dont want to send traffic to publish that is unnecessary and can simply be handled by other system. Adobe IO could possible be one avenue you could check
301 redirects are cached by browsers, so these requests wouldn't even go to dispatcher once cached in browser. Any reason you are trying to do 301?And I assume you want to pass client id and secret in headers?
Its just about adding clientlib like what is mentioned in the doc in your custom script rather than OOTB headlibs but the flag to use defer is OOTB. You just need to add it in your script where you are loading clientlibs
Here is an article which talks about same requirement. Could possibly give this a shot. https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/find-unused-assets-in-aem/m-p/174281
By any chance do you have any IP whitelisting on SFTP. When you connect from your laptop, it would be trying to access FTP from your IP, whereas in Managed Instance, it would be trying to access from IP of Managed AEM Author?