fix(matcher,plugin): case-insensitive matching, port accumulation, nil guards, doc comments

matcher: fix IPv6 normalization via netip.ParseAddr, port-range overwrite
by switching to []*PortRange map, case-insensitive domain/host matching,
glob.MustCompile→Compile to avoid panic on invalid patterns.

plugin: guard nil *Options in NewGRPCConn and NewHTTPClient; add
HTTPClientTransport helper for idle-connection cleanup.

net/*: add doc comments for all exported symbols (no code changes).

Add 30 tests (matcher_test.go 22, plugin_test.go 8) covering all
matcher types, nil safety, case insensitivity, IPv6 normalization,
port ranges, and plugin option composition.

internal/net/dialer/dialer.go

@@ -16,13 +16,18 @@ import (
 )
 
 const (
+	// DefaultTimeout is the default dial timeout.
 	DefaultTimeout = 10 * time.Second
 )
 
+// DefaultNetDialer is the default Dialer used when a nil Dialer is provided.
 var (
 	DefaultNetDialer = &Dialer{}
 )
 
+// Dialer is a network dialer with support for interface binding, network
+// namespace switching, and socket marking. The zero value is ready to use
+// via DefaultNetDialer.
 type Dialer struct {
 	Interface string
 	Netns     string
@@ -31,6 +36,10 @@ type Dialer struct {
 	Log       logger.Logger
 }
 
+// Dial connects to addr on the named network. If d is nil, DefaultNetDialer
+// is used. When Netns is set, the dial switches into that network namespace
+// before creating the connection. When Interface is set, it iterates the
+// specified interfaces, trying each address in turn.
 func (d *Dialer) Dial(ctx context.Context, network, addr string) (conn net.Conn, err error) {
 	if d == nil {
 		d = DefaultNetDialer