fix: close late proxy listeners and validate HTTP usernames

[cppla]

Summary

Fix two local-proxy startup correctness issues without changing tunnel protocols, authentication wire formats, default configuration or release versions.

• Serialize the permanent shutdown state with listener registration. If Shutdown wins before Serve starts, close the late listener outside the lifecycle/tracker locks instead of accepting after shutdown and potentially leaving the client waiting forever.
• Keep normal shutdown a successful Serve return for both SOCKS5 and HTTP. Preserve duplicate-Serve listener ownership and existing graceful connection draining.
• Reject usernames containing ':' when HTTP or HTTPS proxy listeners are enabled, since Basic authentication cannot encode those usernames. Apply this validation at startup and during offline --check.
• Preserve SOCKS-only colon usernames, colon passwords on all listeners, and existing password/SOCKS length rules. Validation errors contain no credential values.

Verification

• The new deterministic shutdown-before-Serve regression failed on the original code: SOCKS attempted Accept after Shutdown and did not close its late listener.
• Local targeted lifecycle regression tests passed under the race detector for 30 repetitions; independent review also exercised the regression and extended ownership/real-listener cases.
• Tests cover concurrent registration/shutdown, duplicate Serve, listener Close outside both locks, and real loopback listeners.
• CLI tests cover default listeners, HTTP-only, HTTPS-only, startup/offline validation, compatible colon credentials, bounded startup contexts, and zero DNS activity.
• Targeted credential tests passed with the race detector for 10 repetitions.
• Final local make check and make race passed.

Exact PR head 87ea8a38ecd4a97163b77f3b08259657c464b4bc passed CI, CodeQL and Linux namespace/netem integration. CI includes Linux/macOS tests, race detection, reachable vulnerability scanning, four-platform builds, actual Docker integration and the multi-platform OCI image build. No review change requests or open threads were present at merge preparation. No separate remote host or passive-traffic experiment is claimed; no tag or release is created.

Post-merge verification: main commit 49b15b94b2e4f2ba28588d50e84e6ed91fb90ec6 has the identical source tree d005733e389fa3b392a66d5e2f899c6fe043e21b and passed its own push-triggered CI, CodeQL and Linux namespace/netem integration.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Fixes proxy shutdown races and validates usernames incompatible with HTTP/HTTPS authentication while preserving existing protocols and defaults.

Changes:

• Safely handles listener registration during shutdown.
• Treats normal shutdown as a successful Serve return.
• Rejects colon-containing HTTP/HTTPS usernames and documents the restriction.
• Adds lifecycle and credential validation tests.

File	Summary
internal/​proxy/​socks5.go	Handles late listener registration during shutdown.
internal/​proxy/​lifecycle.go	Coordinates shutdown state and listener ownership.
internal/​proxy/​lifecycle_test.go	Tests lifecycle races and listener ownership.
internal/​proxy/​http.go	Handles late listener registration and clean shutdown.
docs/​DEPLOYMENT.md	Documents HTTP-compatible username restrictions.
cmd/​autocar/​proxy_credentials_test.go	Tests startup and offline credential validation.
cmd/​autocar/​main_test.go	Updates credential validation coverage.
cmd/​autocar/​client.go	Validates HTTP/HTTPS username compatibility.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.