L4 (TCP/UDP) proxy support + proxy traffic E2E suite + fixes

[aloks98]

Summary

Brings the Layer 4 (TCP/UDP) proxy feature to mergeable, production-verified state, adds an end-to-end traffic test suite for the whole proxy system (L7 + L4), and fixes the real bugs that surfaced.

Feature

• L4 proxies: TCP/UDP routing via the Caddy layer4 plugin — 9 matcher types (any/tls/ssh/postgres/http/rdp/socks5/remote_ip/regexp), load balancing, TLS passthrough/terminate, proxy-protocol. Full stack: model → repo → service → handler → routes, sync integration, RBAC, migrations, UI (list/create/detail + nested form), dashboard stats.
• UI redesign (Copper theme, dashboard overhaul, branding) and audit-config security-event safeguards (carried on this branch).

Build/quality fixes

• Docker build was broken: caddy-l4 v0.1.1 requires Caddy 2.11.3 but the builder image was pinned to 2.10.2 → bumped to caddy:2.11.3-builder and pinned caddy-l4@v0.1.1 so an upstream release can't silently break the build again.
• Fixed the red UI lint gate (a11y errors in the ACL branding preview).

Proxy traffic E2E suite (make test-traffic)

A build-tagged (//go:build traffic) testcontainers suite that drives real traffic through Caddy — not just config generation. 13 scenarios:

• L7 (HTTP via :80): reverse_proxy, round-robin LB, redirect, static, block_exploits, ACL basic-auth. (custom_headers covered in the stacked PR.)
• L4 (raw connections): any/TCP echo, http matcher, round-robin LB, remote_ip allow/deny, postgres SELECT 1, TLS SNI passthrough.

Bugs the suite found and fixed

• 🔴 ACL access-control bypass: basic-auth and IP allow/deny ACLs were silently dropped from the generated Caddy config whenever ACL_WAYGATES_LOGIN_URL was unset (its default) — a proxy could show auth configured while Caddy served it wide open. Now the ACL builder is always constructed; forward-auth additionally fails closed when its URLs are unset.
• 🔴 L4 http matcher generated invalid Caddy config ({"http":{}} object vs the required caddy-l4 RawMatcherSets array) — sync 500'd and the entire layer4 app failed to load. Fixed to serialize as an array.

Test plan

• make backend-test (unit) — green
• make test-traffic (Docker required) — all L7 + L4 scenarios pass
• pnpm --dir ui build + make lint-ui — green

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 84.77193% with 217 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.64%. Comparing base (29e85fc) to head (1fc08c4).

Files with missing lines	Patch %	Lines
backend/internal/api/middleware/request_logger.go	0.00%	58 Missing ⚠️
backend/internal/service/sync_service.go	18.51%	42 Missing and 2 partials ⚠️
backend/internal/service/mocks/mocks.go	40.38%	31 Missing ⚠️
backend/internal/caddy/config/builder.go	30.55%	23 Missing and 2 partials ⚠️
backend/internal/caddy/config/layer4_builder.go	89.65%	17 Missing and 4 partials ⚠️
backend/internal/api/routes/routes.go	0.00%	14 Missing ⚠️
backend/internal/repository/l4_proxy_repository.go	85.24%	5 Missing and 4 partials ⚠️
backend/internal/caddy/config/acl_builder.go	63.15%	5 Missing and 2 partials ⚠️
backend/internal/service/l4_proxy_service.go	97.81%	3 Missing and 3 partials ⚠️
backend/internal/api/handlers/l4_proxy_handler.go	99.25%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #14      +/-   ##
==========================================
+ Coverage   71.82%   73.64%   +1.81%     
==========================================
  Files          48       57       +9     
  Lines        8614    10027    +1413     
==========================================
+ Hits         6187     7384    +1197     
- Misses       2066     2264     +198     
- Partials      361      379      +18     

Flag	Coverage Δ
backend	73.64% <84.77%> (+1.81%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.