fix(matcher,plugin): case-insensitive matching, port accumulation, nil guards, doc comments

matcher: fix IPv6 normalization via netip.ParseAddr, port-range overwrite
by switching to []*PortRange map, case-insensitive domain/host matching,
glob.MustCompile→Compile to avoid panic on invalid patterns.

plugin: guard nil *Options in NewGRPCConn and NewHTTPClient; add
HTTPClientTransport helper for idle-connection cleanup.

net/*: add doc comments for all exported symbols (no code changes).

Add 30 tests (matcher_test.go 22, plugin_test.go 8) covering all
matcher types, nil safety, case insensitivity, IPv6 normalization,
port ranges, and plugin option composition.

internal/net/http/http.go

@@ -8,6 +8,8 @@ import (
 	"strings"
 )
 
+// GetClientIP extracts the client IP from the request, checking CF-Connecting-IP,
+// X-Forwarded-For, and X-Real-Ip headers in that order.
 func GetClientIP(req *http.Request) net.IP {
 	if req == nil {
 		return nil
@@ -27,6 +29,7 @@ func GetClientIP(req *http.Request) net.IP {
 	return net.ParseIP(sip)
 }
 
+// Body wraps an io.ReadCloser with size-limited recording of the data read.
 type Body struct {
 	r          io.ReadCloser
 	buf        bytes.Buffer
@@ -34,6 +37,7 @@ type Body struct {
 	recordSize int
 }
 
+// NewBody creates a Body that reads from r and records up to maxRecordSize bytes.
 func NewBody(r io.ReadCloser, maxRecordSize int) *Body {
 	p := &Body{
 		r:          r,
@@ -63,10 +67,12 @@ func (p *Body) Close() error {
 	return p.r.Close()
 }
 
+// Content returns the recorded content.
 func (p *Body) Content() []byte {
 	return p.buf.Bytes()
 }
 
+// Length returns the total number of bytes read from the underlying reader.
 func (p *Body) Length() int64 {
 	return p.length
 }