Fix 14 deep-review findings across security, concurrency, and API

[kriszyp]

Summary

Addresses all 14 findings from a deep code review of the symphony proxy. No new features — correctness and security fixes only.

Changes

Security / TLS

• Private key now included in TLS config cache key — routes sharing a cert chain but different keys (mid-rotation) no longer silently share a ServerConfig (src/tls.rs)
• Private key PEM bytes wrapped in zeroize::Zeroizing<Vec<u8>> so key material is zeroed on drop (src/tls.rs, Cargo.toml)
• requireClientCert default changed true → false; omitting the field from an mtls block no longer silently enforces mandatory client certs — breaking change for callers that relied on the implicit default (src/proxy.rs, ts/types.ts)

Concurrency

• Per-IP concurrency limit: replaced read+separate-write with fetch_update atomic test-and-increment to close the TOCTOU window (src/protection.rs)
• Token bucket refill: replaced store on last_refill_ns with compare_exchange so concurrent threads cannot double-credit the same epoch (src/protection.rs, src/router.rs)
• AllowBypassed Decision variant — allowlisted connections no longer call release() on a counter that was never incremented (src/protection.rs, src/proxy_conn.rs)

Reliability / API

• Upstream connect (TCP + UDS) now has a timeout (defaults to TLS handshake timeout or 30 s); previously a firewall black-hole would block a tokio task indefinitely (src/upstream.rs)
• idleTimeoutMs: 0 now means "no timeout" instead of dropping every connection instantly (src/proxy.rs, src/proxy_conn.rs)
• Wildcard SNI routing now enforces exactly one left-most label: *.example.com no longer matches a.b.example.com (src/router.rs)
• Invalid CIDR strings in allowlist/blocklist are now config errors surfaced to JS, not silently dropped rules (src/proxy.rs)
• SNI normalized: trailing dot trimmed, empty/oversized/malformed values return None (src/sni.rs)
• PROXY protocol v1: IPv4-mapped IPv6 addresses (::ffff:1.2.3.4) now emit TCP4 header so HAProxy/nginx don't reject the connection (src/upstream.rs)
• toJsRoute now passes maxConnectionsPerSecond and burst; previously per-route rate limiting was silently dead (ts/proxy.ts)
• ResolveRoute.upstream changed from Upstream[] to single Upstream to match actual semantics (ts/types.ts, ts/proxy.ts, src/proxy.rs)

Attention areas

• The requireClientCert default flip is the one change most likely to affect existing callers. Anyone with mtls: { clientCaCert: "..." } without an explicit requireClientCert: true will now get optional client auth instead of mandatory. Review call sites.
• The wildcard single-label fix could route traffic differently if any existing wildcard routes were intentionally matching multi-label subdomains (non-RFC-compliant but previously accepted). Unlikely but worth checking.
• All 11 existing tests pass; the suspended.spec.ts test updated for the upstream rename.

🤖 Generated by Claude Sonnet 4.6