Add advanced proxying features: rate limiting, CPU-aware balancing, source address forwarding, HTTP/2 ALPN

[kriszyp]

Summary

• Per-route rate limiting (maxConnectionsPerSecond, burst): route-wide token bucket to prevent one route from starving others. Connections dropped silently when exhausted.
• Per-upstream CPU utilisation monitoring: UDS upstreams can declare a Linux pid/tid; symphony samples /proc/{pid}/task/{tid}/stat every 250ms and incorporates measured CPU utilisation as a secondary tiebreaker in socket selection (score = active_connections × 1000 + cpu_util_permille).
• Source address forwarding (sourceAddressHeader): per-route choice of PROXY Protocol v1 (default for UDS), X-Forwarded-For header injection (for backends that don't support PROXY Protocol), or none (default for TCP).
• HTTP/2 ALPN (http2): opt-in per route/resolveConnection. When true, advertises ['h2', 'http/1.1'] in TLS ALPN so clients negotiate HTTP/2; raw H2 frames flow through copy_bidirectional unchanged — no HTTP parsing. Requires terminateTls: true. Default false (backward compatible).

Purpose

Harper's UDS workers run in separate threads and processes. These features allow symphony to:

• Enforce fairness between routes under load
• Route new connections to less-loaded threads using real CPU utilisation data
• Propagate the real client IP to upstream servers that need it
• Support HTTP/2 negotiation transparently for upstreams that serve h2

Areas for attention

• CPU monitoring (balancer.rs): update_cpu_stats() uses fixed-point arithmetic and CAS stores on AtomicU32/AtomicU64 per slot. The /proc read is blocking I/O done on a tokio worker thread (250ms interval); it's short-lived but it's not offloaded to a blocking thread pool. Low risk at 250ms cadence.
• X-Forwarded-For injection (http_proxy.rs): peeks at the first bytes of the request to find the end of the request line, then splices in the header. This is a best-effort parse — it expects well-formed HTTP/1.x. Malformed or HTTP/2 requests on a non-http2 route skip the header insertion.
• TlsConfigCache key now includes (cert_sha256, mtls_sha256, http2). Routes sharing cert + mTLS but differing in ALPN get distinct ServerConfig instances — correct, but worth confirming the hash covers all relevant config.
• resolveConnection + http2: Gemini review flagged that the resolution path originally hardcoded http2=false. Fixed in the ALPN commit — JsResolveRoute now carries http2 and threads it through build_resolved_route.

🤖 Generated with Claude Code