fix(web): share H2 initialization and join client closure

[cppla]

Summary

• Share client-owned cold H2 physical initialization among callers. Each caller owns only its wait and CONNECT; canceling one caller does not cancel another caller's setup.
• Preserve a completed attempt for callers already queued at session selection. A genuinely later invocation can retry without permanently caching a failure.
• Publish unclaimed H2 sessions without generating authentication or sending CONNECT until a live caller claims bootstrap; retain full then short connection-bound authentication.
• Make concurrent H2 Close calls join unpublished setup and detached session cleanup and return the same completed result.
• Preserve independent TCP and TLS/H2/HRR budgets, caller cancellation causes, failed-dial connection ownership and fail-closed nil results. Document the source-build behavior and limits.

Validation

• Three original once-only negative controls on main c4ce94d demonstrated cancellation/failed-connection ownership, non-joined Close, and non-shared initialization gaps before the implementation.
• Automated review of the first head identified a further queued-caller fast-failure boundary. A new frozen test failed once against 4c47c00: queued callers received replacement error objects and two physical dial calls instead of one; the later real verifying TLS/H2 two-flow full/short-auth echo controls still succeeded. The follow-up captures the selection cohort before queue admission and retains its immutable result.
• Repaired-source focused selection: 12 test tops / 45 terminal cases (nine new tops / 15 cases plus three adapted legacy initialization tops / 30 cases). Cached Go 1.25.13 race x5, Go 1.27.1 race x3, and isolated Linux/arm64 x3 all pass with no focused FAIL or SKIP.
• Full make check and make race on the repaired source pass. Owned healthy controls exercise actual numeric-loopback verified TLS/H2, full/short authentication, physical reuse and complete TCP echo payloads.
• Fresh repaired PR-head CI, CodeQL and native netem, followed by independent merged-main checks, are required separately; the original head's green CI is not reused as evidence for the repair.

Scope

No dependency/native-protocol change, new release/tag, registry publication, SSH deployment or formal browser/PCAP comparison. These changes apply to source builds after v1.0.1, not the existing release binary. No browser equivalence, general connection-speed or recognition ranking claim. Close joins our owned workers, not every dependency goroutine; cancellation-ignoring custom callbacks must still return.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Interacting initialization, authentication, and shutdown synchronization changes warrant final human review despite no confirmed defects.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the web-cover H2 client to share cold initialization across callers and wait for owned setup and cleanup during shutdown.

Changes:

• Shares initialization results while keeping caller cancellation independent.
• Defers authentication until a live caller reserves a stream and handles invalid dial results.
• Adds lifecycle regression tests and documents the ownership guarantees.

File	Description
internal/​tunnel/​web_h2_initialization_test.go	Tests cancellation and shutdown at initialization handoff.
internal/​tunnel/​web_h2_dial_sharing_test.go	Tests shared attempts, retries, cancellation, and authentication.
internal/​tunnel/​web_h2_dial_result_test.go	Tests caller preflight errors and dial-result ownership.
internal/​tunnel/​web_h2_close_join_test.go	Tests shutdown waiting for late dials and detached cleanup.
internal/​tunnel/​web_h2_client.go	Implements shared initialization and coordinated closure.
docs/​WEB_COVER.md	Documents H2 initialization and shutdown guarantees.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c47c00b0d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".