fix: preserve HTTP response integrity and streaming delivery

[cppla]

Summary

• Abort a forwarded HTTP response when the origin body copy fails, instead of finalizing a truncated chunked response as success.
• Flush headers and body writes for unknown-length responses and text/event-stream, allowing small events to arrive while the origin is still open.
• Retain ordinary fixed-length buffering, declared trailers after successful completion, and compatibility with non-flushing ResponseWriter wrappers. CONNECT and tunnel transport behavior are unchanged.
• Document source-build behavior and its release boundary.

Regression evidence

• Before the fix, a real local HTTP/1.1 origin that omitted its terminating chunk produced successful 200 responses for both 32-byte and 64-KiB bodies. Both now produce io.ErrUnexpectedEOF after delivering the data prefix.
• Before the fix, unknown-length and known-length event streams both timed out awaiting response headers while the origin waited for the test to consume its first event. Both now deliver the first event before the origin is released, then finish normally.
• Added successful chunked/trailer coverage plus header/body flush, read/write error, ordinary buffering and unsupported-flusher tests.
• Targeted HTTP race tests x5, full make check, full make race, formatting and independent review passed.
• Isolated Linux/arm64 Docker tests passed: 16 top-level HTTP/copy tests x5 (80 passes), matching source hashes before/after build and execution; container removed.
• Exact head 876c564f872f32de8a2329a8e2ea2b5345ccb261: CI 35812695416 (all 11 jobs including actual container integration and OCI build), CodeQL 35812695428 and Linux netem 35812695436 all completed successfully.
• Independent review found no blocking issue; no unresolved GitHub review threads.

Scope

HTTP forward-proxy correctness and real-time streaming only. No protocol, credentials, dependency, transport-controller default, release or tag changes. No claim of general throughput or passive/browser similarity improvement.

Merge verification

• Squash-merged to main as 413afacedf366f97150149e3c237c35c7cf9289a. Its tree is identical to the tested head: 86c5d4c9bba1af575dab220a8c1822bf87141c98.
• Exact-main CI 35812915275 passed all 11 jobs, including actual Docker integration and OCI build.
• Exact-main CodeQL 35812915238 and Linux netem 35812915227 passed; namespace/netem execution completed successfully.
• Independent and automated reviews have no blocking findings or unresolved inline threads. Local main is clean and equal to origin/main. No release or tag was created.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation and regression coverage are complete; only a minor documentation nit remains.

Review effort: Lite
Findings: None

What changed in this PR

This pull request improves HTTP response integrity and real-time streaming in the forward proxy.

Changes:

• Abort truncated responses when origin body copying fails.
• Flush unknown-length and SSE responses incrementally.
• Add regression coverage and document forwarding behavior.

File	Summary
internal/​proxy/​http.go	Implements response-copy error handling and flushing.
internal/​proxy/​http_test.go	Updates stalled-response expectations.
internal/​proxy/​http_response_integrity_test.go	Adds truncation, streaming, and trailer tests.
internal/​proxy/​http_response_copy_test.go	Tests flushing and copy errors.
docs/​DEPLOYMENT.md	Documents forwarding behavior and source-build release boundaries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.