fix(httpproxy): keep offline connector backendRef in extension-server mode

[scotwells]

Problem

An offline connector backing an HTTPProxy serves a bare HTTP 500 with an empty body instead of the "Tunnel not online" 503 page the legacy EnvoyPatchPolicy (EPP) approach used to serve.

Confirmed live:

• Public prod proxy tear-backing-9r3fd.datumproxy.net → HTTP 500, empty body. Its connector datum-connect-mhxj5 is Ready=False / ConnectorNotReady ("Connector lease has expired. Agent may be offline.").
• On the staging data plane the offline vhost's only route is direct_response: { status: 500 } — no connect_matcher, no 503, no connector cluster.

Root cause

When a connector is not Ready, collectDesiredResources emitted the route rule with BackendRefs: nil.

• EPP mode (legacy): correct — EG translates the backend-less rule into a virtual_host and buildConnectorOfflineEnvoyPatches inserts the direct_response 503 CONNECT route.
• Extension-server mode (eppEmissionEnabled: false, now the default on staging and prod): the ext-server keys its offline handling on the presence of a connector cluster, which EG only emits when the route rule carries a backendRef. With a null backendRef, EG produces no cluster, the ext-server's offline map stays empty (ApplyConnectorRoutes finds nothing to key on), and EG renders the backend-less route as a bare direct_response 500.

The ext-server's offline branch itself works — on staging it fires (clusters_offline / vhosts_connector_applied > 0) once a cluster is present. It classifies online/offline purely from the replicated Connector Ready condition (internal/extensionserver/cache/index.go), ignoring stale connectionDetails. The only missing ingredient is the cluster.

Fix

Only take the null-backendRef path when EPP emission is enabled. In extension-server mode an offline connector now falls through to the same connector.local placeholder EndpointSlice + backendRef as an online connector. EG renders a connector cluster, and the ext-server inserts the 503 "Tunnel not online" route itself.

This also decouples NSO routing from connector readiness in Mode B — NSO emits a stable backendRef regardless of connector state, and the ext-server owns the online/offline decision on every translation.

Test

Adds a Mode-B (eppEmissionDisabled: true) reconcile case asserting the offline connector route keeps its backendRef + placeholder EndpointSlice and that no EPP is emitted. The existing EPP-mode offline test (default config) is unchanged and still asserts the empty-backendRef + EPP behavior.

go test ./internal/controller/... ./internal/extensionserver/... -count=1   # ok
go vet ./internal/controller/...                                            # ok

Notes / follow-ups

• This restores the offline page; the online connector promotion path (cluster → CONNECT/internal-upstream tunnel) is still unverified end-to-end on a live data plane (no fully-online connector with valid connectionDetails was available to exercise it) — tracked separately.
• The EG re-translation trigger gap (status-only connector transitions not re-running translation) is a separate known issue and out of scope here.

🤖 Generated with Claude Code