fix(proxy): strip hop-by-hop response headers

[mstuart]

Summary

• strip the complete standard hop-by-hop response-header set
• also strip extension headers named by an upstream Connection header
• retain end-to-end response headers and add a regression test

Why

The proxy previously removed only connection and transfer-encoding (plus regenerated content-length). Forwarding headers such as keep-alive, upgrade, or connection-nominated extension fields can leak transport-specific state across the proxy boundary and produce malformed downstream responses.

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• cargo build --workspace --release
• npm run check
• npm test

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T22:15:58.186723Z	44897ad	PR opened
🔒 Security Review	✅ Completed 2026-09-25T22:17:02.290483Z	44897ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.