Tighten L7 proxy identity and fallback visibility

[kacy]

Summary

• add proxy-generated forwarded headers so backends can recover original client identity without trusting inbound values
• surface whether VIP-bound HTTP is actually using the L7 proxy or falling back to L4
• update the Phase 6 design notes to make source-IP and bypass behavior explicit

Commits

• 54b43f7 Add forwarded client headers to L7 proxy
• d6a2f47 Expose L7 VIP fallback mode in status

Testing

• targeted zig build test runs were executed one at a time for the rewritten-header path, socket proxy path, forwarding path, runtime route snapshot, service proxy-routes response, and rollout status sample-route response
• each targeted run hit the explicit timeout without emitted failures