fix,docs: Loopback self-redirect guard + document IP-level gating

Address follow-up review on the transparent listener:

- transparentproxy.dispatch: drop connections whose SO_ORIGINAL_DST is a
  loopback address. A genuinely REDIRECTed connection never has a loopback
  original destination (the enforce-redirect iptables RETURN loopback before the
  REDIRECT), so a loopback dst means a direct dial to the listener port where
  SO_ORIGINAL_DST reports the listener's own address — tunnelling to it would
  spiral into ever more connections/goroutines. Defense-in-depth.

- HandleTransparentConn: document the gating-key difference. CONNECT gates on
  the hostname (r.Host); captured traffic gates on the SO_ORIGINAL_DST IP:port,
  so domain-based egress policy does not match captured bypass traffic the way
  it matches explicit-proxy traffic. Acceptable while opt-in; the always-on
  operator PR must first add SNI-peek for parity or consciously accept IP-level
  policy. Tracked as a prerequisite for the default flip.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/listener/forwardproxy/transparent.go

@@ -26,6 +26,18 @@ import (
 // gates, dials dst, and copies bytes both ways. dst is "host:port" recovered
 // from SO_ORIGINAL_DST by the transparent listener.
 //
+// GATING LIMITATION (important before enforce-redirect goes always-on):
+// CONNECT carries a hostname in r.Host, so the outbound pipeline gates captured
+// CONNECT traffic on the domain (e.g. "api.openai.com:443"). SO_ORIGINAL_DST
+// yields only an IP:port, so here pctx.Host is an IP literal. Any host/domain-
+// based egress policy (allowlist-by-domain, host->audience routing) therefore
+// does NOT match captured bypass traffic the way it matches explicit-proxy
+// traffic — the gate runs, but sees an IP. This is acceptable while the operator
+// flag keeps enforce-redirect opt-in, but the always-on operator PR MUST first
+// either (a) peek the TLS ClientHello SNI here and set pctx.Host to the SNI
+// hostname for parity with CONNECT, or (b) consciously accept IP-level egress
+// policy for captured traffic. Tracked as a prerequisite for the default flip.
+//
 // HandleTransparentConn owns clientConn's lifecycle and always closes it.
 func (s *Server) HandleTransparentConn(clientConn net.Conn, dst string) {
 	defer func() { _ = clientConn.Close() }()

authbridge/authlib/listener/transparentproxy/server.go

@@ -76,5 +76,19 @@ func (s *Server) dispatch(conn *net.TCPConn) {
 		_ = conn.Close()
 		return
 	}
+	// Defense-in-depth against a self-redirect loop: a genuinely REDIRECTed
+	// connection never has a loopback original destination (the enforce-redirect
+	// iptables rules RETURN loopback before the REDIRECT). So a loopback dst here
+	// means a direct dial to the listener port, where SO_ORIGINAL_DST reports the
+	// listener's own address — tunnelling to it would spiral into ever more
+	// connections/goroutines. Drop it.
+	if host, _, splitErr := net.SplitHostPort(dst); splitErr == nil {
+		if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
+			slog.Warn("transparent-proxy: dropping connection whose original destination is loopback (not a redirect; would self-loop)",
+				"remote", conn.RemoteAddr().String(), "dst", dst)
+			_ = conn.Close()
+			return
+		}
+	}
 	s.handle(conn, dst)
 }