feat: l7 proxy dispatches mtls upstreams to client_dial

[kacy]

summary

PR-5 final wiring (after #440, #441, #442, #443). teaches the L7 reverse
proxy's outbound forwardSingleAttempt to dispatch on
upstream.peer_mode and use client_dial.dial (#442) when mTLS is in
play. with this PR, the data-plane code path is complete — once a
service's tls.peer reaches the service-registry state (the one
remaining cluster-DB schema migration), inbound and outbound legs
both run mTLS end-to-end.

what's in here

split into two commits for review:

1. carry peer_mode through the spec-side types

• Upstream gains a peer_mode field (default .off)
• ServiceDefinition, ServiceState, ServiceSnapshot gain
  peer_mode and the apply/snapshot paths propagate it
• resolveUpstreamWithPolicy copies peer_mode from the service
  snapshot onto every candidate Upstream and onto the returned one

2. dispatch + mTLS attempt in the reverse proxy

• forwardSingleAttempt early-branches on upstream.peer_mode != .off
  into a new forwardSingleAttemptMtls:
  • loads the cluster CA from raft state (store.getClusterCa)
  • dials via client_dial.dial(ca_cert_pem=...)
  • writes the request and drains the response through the session
  • the connection is never pooled (mTLS sessions carry encryption
    state — sharing one across requests would corrupt the stream)
• policy when the cluster CA isn't seeded:
  • .require ⇒ returns error.ClusterCaMissing
  • .warn ⇒ logs and falls back to plaintext via the new
    forwardPlainAttempt helper (an exact copy of the legacy leg
    of forwardSingleAttempt, so service traffic keeps flowing
    while the bootstrap thread catches up)
• new readResponseFromSession: session-aware drain that reads
  until error.PeerClosed (the session's orderly EOF) or max_bytes

design notes

• no session pool: the L7 connection pool keys on (endpoint_id, address, port) and stores raw fds. mixing fds and TLS sessions
  under one key would yield catastrophic checkouts (a session's
  encryption counters can't be picked up by a fresh handshake at
  the same address). a session pool would need a separate per-target
  map and a "is this session still healthy" check; left as a follow-up
  once we see real throughput numbers.
• policy at the boundary: .warn falling back to plaintext is the
  spec's intent — it's the migration mode that proves the rest of the
  stack works before flipping a service to .require. when the CA is
  present, both .warn and .require run the same handshake.
• mirror + http/2 paths: unchanged. they call
  socket_helpers.connectToUpstream directly. those paths get the
  same treatment in a follow-up once we have HTTP/1.1 mTLS in
  production.

tests

three new tests on readResponseFromSession against a duck-typed
FakeSession (same shape client_session.ClientSession exposes):

1. concatenates chunks until peer closes
2. returns ResponseTooLarge when max_bytes is exceeded
3. returns an empty buffer on immediate close

the live mTLS handshake itself is already exhaustively covered by:

• socketpair tests in client_session.zig (feat: tls 1.3 client session driver #438): client happy + 2
  rejects
• socketpair tests in session_runtime.zig (feat: server-side mtls — certificaterequest + client-cert verify #439): server happy +
  empty-cert reject + warn-mode accept
• real-tcp tests in client_dial.zig (feat: client_dial helper — open a tcp socket and run mtls handshake #442): bare + mTLS round-trip

what's deferred (and why)

• cluster-state-DB column for peer_mode — the bridge from the
  manifest loader → service store row → service registry. without
  it, Upstream.peer_mode stays .off in production. small dedicated
  migration: add a column, update services_types.zig + the raft
  INSERT/UPDATE SQL builders, copy through in
  serviceDefinitionFromRecord. one-shot schema PR; out of scope for
  this one.
• session pool — see design notes; revisit with real throughput data.
• mirror + HTTP/2 dispatch — same pattern, follow-up once HTTP/1.1
  mTLS has burn-in.

verification

• full unit suite green (2234 passed, 2 skipped, 0 failed)
• tools/panic_audit.sh clean
• zig fmt --check clean

still no auto-merge — security-sensitive data-plane.