Optimize dev proxy upstream performance

[aram356]

Closes #895

Summary

• Add repeatable dev-proxy performance metrics and benchmark workloads for sequential, matched-concurrency, saturation, DNS, parser, and remote-latency scenarios.
• Add a bounded HTTP/1.1 upstream connection manager with safe streaming lease return, cancellation, stale-connection retry, connector ownership, and bounded shutdown.
• Retain evidence-backed CONNECT-head parsing and DNS caching while rejecting HTTP/2 and TCP_NODELAY experiments that did not satisfy their retention gates.
• Precompute upstream identities and preserve TLS, Host, --resolve, Basic authentication, hop-by-hop sanitation, and blind-tunnel isolation.

Final review corrections

• Count complete responses as successful independently from whether their upstream connection is reusable, including already-empty and Connection: close responses.
• Force stale-readiness recovery through a fresh reservation instead of selecting another idle sender.
• Remove the rejected HTTP/2 application-mode key state; retained TLS configurations advertise only HTTP/1.1.
• Forward response trailers before lease reconciliation and preserve every downstream trailer declaration.
• Backfill connector cancellation/unwind, early-response, browser-cancellation, truncated-body, trailer, credential-isolation, insecure-warning, forwarding-capacity, over-read, shutdown-order, and origin-key integration coverage.

Performance results

• Sequential TLS: 100 connections and handshakes reduced to 1, with a 59.7% median duration improvement in the recorded alternating runs.
• DNS churn workload: 13.6% median improvement with one miss and 99 cache hits.
• Concurrency-20 saturation: bounded to six upstream connections and handshakes.
• Remote saturation diagnostic: six pooled connections reduce connection and handshake churn by 94%; the six-connection safety cap intentionally trades 9.0% duration versus the unbounded baseline at concurrency 20.

Full measurements and experiment decisions are recorded in docs/superpowers/implementation-notes/2026-07-10-dev-proxy-performance.md.

Verification

• cargo fmt --all -- --check
• CLI cargo check --tests and Clippy with -D warnings
• ./scripts/test-cli.sh — 147 unit + 26 E2E tests
• All six ignored proxy_perf workloads with one test thread
• Fastly, Axum, Cloudflare, Spin, and 13 cross-adapter parity tests
• Native/Wasm Clippy matrices for Fastly, Axum, Cloudflare, and Spin with zero warnings
• JS build + 405 Vitest tests + JS/docs Prettier checks

[prk-Jr]

Summary

Adds a bounded, reusable HTTP/1.1 upstream connection manager (plus DNS caching, precomputed upstream identities, and a repeatable benchmark suite) to ts dev proxy. The design is careful and thoroughly tested: the manager is an actor with a bounded ordinary lane + unbounded control lane so lifecycle events (cancel / driver-closed / shutdown) can never deadlock behind a saturated acquire lane, and capacity reconciliation is airtight — every path leads back to release(id) (reservation drop → ConnectFailed, driver-guard drop → DriverClosed, shutdown connector abort → finish error → reservation drop). The AcquireTicket single-terminal-transition invariant closes the resolve/cancel race. No blocking issues found; approving.

Non-blocking

♻️ refactor

• Crypto provider rebuilt per call: NoVerifier::supported_verify_schemes calls aws_lc_rs::default_provider() (a non-trivial clone) on every invocation — cache in a OnceLock. --insecure-only path, cosmetic. (connect.rs:282)

🌱 seedling

• Non-idempotent 502 on stale reuse: the send_request retry is gated on provably-empty idempotent requests, so a POST racing an upstream idle-close returns 502 rather than replaying. This is the correct safe behavior; flagged only so it's a documented trade-off. (upstream/mod.rs:246)

⛏ nitpick

• Doc comments on new pub items: several new public items (ProxyMetrics::record_*, PooledResponseBody::new, etc.) lack doc comments. CLAUDE.md asks for one per public item; missing_docs isn't enforced here and it matches surrounding CLI style, so optional.

👍 praise

• Lifecycle & concurrency design: the can_reuse matrix + exhaustive test, DNS miss-coalescing that survives owner cancellation without poisoning the in-flight key, the trailer-frame deferral in PooledResponseBody, and the priority_shutdown_overtakes_a_saturated_ordinary_lane test are all excellent.
• Security hardening: Basic-auth refused on non-loopback binds, hop-by-hop + Connection-token stripping, Forwarded / Fastly-SSL stripped and authoritatively re-stamped, strict host validation before PAC / Host-header embedding, and redacted BasicAuth Debug.

CI Status

• fmt: PASS
• clippy (fastly/axum/cloudflare/spin native+wasm): PASS
• rust tests (fastly/axum/cloudflare/spin/CLI/parity): PASS
• js build + vitest + docs/ts prettier: PASS

[ChristianPavilonis]

Summary

Approved with seven actionable follow-ups noted inline. The pooled HTTP/1 architecture and coverage are strong; the highest-priority changes are preserving request trailers end-to-end and tying connector-capacity release to actual task termination.