[jamiesun]

Summary

• add a TLS-transparent SNI egress listener bound to a snapshot identity and closed DNS origins
• reuse policy, egress, rate and connection limits, tracing, and access logs with fail-closed denials
• add direct, HTTP CONNECT, SOCKS5, rejection, limit, and throughput coverage plus operator documentation

Validation

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test --locked -q
• cargo llvm-cov --locked --all-targets --summary-only --fail-under-lines 80 (84.53% lines)
• cargo build --release --locked --bins
• mdbook build
• ./scripts/check-public-tree.sh