fix(web): preserve origin encoding and H3 overload semantics

[cppla]

Changes

• Disable automatic gzip negotiation/decoding only on the cover proxy's private default upstream transport. Preserve encoded response bytes together with Content-Encoding, length, Content-Digest and ETag. Explicit client gzip still works; caller-supplied transports retain their own policy.
• Use HTTP/3 H3_EXCESSIVE_LOAD (0x107) for public connection-admission exhaustion instead of the native relay code (0x102, meaning H3_INTERNAL_ERROR in H3). Native relay behavior and admission bookkeeping are unchanged.
• Add real owned-loopback regression tests for both proxy constructors, H1/H2/H3 visitor and invalid-ticket requests, same-connection continuation, compression controls, and global/per-source H3 rejection and recovery. Document source-build boundaries.

Validation

• Frozen old-production controls reproduced body/digest mismatch and actual remote H3 0x102 rejection; healthy controls remained usable.
• Cached Go 1.25.13: complete make check and make race passed; check includes 49 Python release-contract tests.
• Four focused tests, 28 distinct terminal cases: Go 1.25.13 race x5 (140 case executions), Go 1.27.1 race x3 (84), and isolated Linux/arm64 Docker x3 (84); all selected cases passed without skips.
• Linux used cached images, no external networking, read-only mounts/root, dropped capabilities and exact-owned container cleanup. Source/binary hashes remained unchanged.
• Independent source review found no functional must-fix issue. The sole documentation grammar comment was corrected and resolved in b16c033; all Go/test/dependency inputs are unchanged from the locally validated 55963aa. Original-head, final-head and independent merged-main checks passed; their evidence is kept separate.

Scope

Functional website compatibility and overload semantics only. No claim of browser equivalence or passive-classification superiority, no restart of the canceled capture campaign, no remote deployment, and no new release/tag. The published v1.0.1 binary is unchanged.

Final publication verification

Squash-merged into main as c4ce94dea7d1ac7a14d4f5b176c12e4fedfe2aeb at 2026-10-02 23:36:14 UTC. The final PR head and merged main share tree 0349c5e2c0791eab20a89a9260d988f99956613a; main's sole parent is the guarded base 556f9948d48ab64b28529ae5eb81d26abf737792.

• Final PR-head checks: CI, CodeQL, netem: all 13 jobs succeeded, attempt 1.
• Independent merged-main push checks: CI, CodeQL, netem: all 13 jobs succeeded, attempt 1. Actual logs directly check out the merged main commit.
• Local main was fast-forwarded and is clean; all nine final source hashes match. Existing native netem controls are not a new Web/browser-fingerprint experiment. No new release/tag or remote deployment was performed.

[Copilot]

Copilot review overview

🟢 Approval recommended

The functional changes are focused and comprehensively tested; only a minor documentation grammar correction remains.

Review effort: Balanced
Findings: 1

Open (1)

• Use plural possessive “their” for “Applications” · New

What changed in this PR

Preserves encoded cover responses and applies correct HTTP/3 overload semantics.

Changes:

• Disables automatic compression for default cover transports.
• Uses H3_EXCESSIVE_LOAD for H3 admission rejection.
• Adds protocol-wide regression coverage and documentation.

File	Description
internal/​tunnel/​web_limits.go	Corrects H3 overload error code.
internal/​tunnel/​web_h3_admission_error_test.go	Tests admission rejection and recovery.
internal/​tunnel/​web_cover_representation_test.go	Tests representation preservation across H1–H3.
internal/​cover/​representation_test.go	Tests default and custom transport compression policies.
internal/​cover/​public_origin.go	Documents custom transport behavior.
internal/​cover/​handler.go	Disables default automatic compression.
docs/​WEB_COVER.md	Documents overload and encoding behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.