HTTP/2 CONNECT proxy with mTLS client auth and policy enforcement

Proxy accepts HTTP/2 CONNECT requests over mTLS, extracts a custom X.509
extension from the client certificate, and evaluates it against a TOML
policy to authorize connections to requested destinations. Allowed
connections are tunneled as opaque TCP via bidirectional byte copy.

Includes structured logging (tracing), OpenTelemetry export, Prometheus
metrics, and a comprehensive test suite (38 integration + 8 e2e tests
covering tunnel success, policy denial, extension enforcement, mTLS
fail-closed, unreachable destinations, and method rejection).

Author: sl5-guy

.devcontainer/devcontainer.json

@@ -0,0 +1,12 @@
+{
+  "name": "agent-gateway",
+  "image": "mcr.microsoft.com/devcontainers/rust:1-bookworm",
+  "runArgs": [
+    "--userns=keep-id"
+  ],
+  "containerUser": "vscode",
+  "updateRemoteUserUID": false,
+  "containerEnv": {
+    "HOME": "/home/vscode"
+  }
+}

.gitignore

@@ -0,0 +1,3 @@
+/target
+.cursor/
+INBOX.md