refactor(handler/http): split handler monolith into 7 focused files with 96 unit tests

Extract the 1024-line handler.go into concern-focused files:
  util.go       — 5 pure functions (decodeServerName, basicProxyAuth, upgradeType,
                  normalizeHostPort, buildConnectResponse) — 100% coverage
  auth.go       — authenticate (5 probe-resistance strategies + knock) + checkRateLimit
  connect.go    — handleConnect, sniffAndHandle, dial, setupTrafficLimiter
  proxy.go      — handleProxy keep-alive loop, proxyRoundTrip, handleUpgradeResponse
  websocket.go  — WebSocket frame sniffing/recording with rate-limited sampling
  udp.go        — UDP-over-HTTP relay with SOCKS5 tunnel
  metadata.go   — metadata struct, parseMetadata, probeResistance type

Key improvements:
- Transport injection (http.RoundTripper field) enables testing without real network
- Nil Router guards in dial, handleUDP, and nil Addr guard in checkRateLimit
- Pure functions converted from methods to package-level (no state dependency)
- setupTrafficLimiter returns cleanup closure to preserve defer lifetime
- handleConnect accepts caller's resp for correct recorder status capture
- Comprehensive package doc with full request-flow documentation

96 tests: 100% on pure functions, 86% on metadata parsing, 55% overall (integration
paths verified by e2e tests).

handler/http/udp_test.go

@@ -0,0 +1,78 @@
+package http
+
+import (
+	"bufio"
+	"context"
+	"net"
+	"net/http"
+	"testing"
+
+	"github.com/go-gost/core/handler"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func TestHandleUDP_Disabled_WritesForbidden(t *testing.T) {
+	h := &httpHandler{
+		options: handler.Options{
+			Logger: &testLogger{},
+		},
+	}
+	h.md.proxyAgent = defaultProxyAgent
+	h.md.enableUDP = false
+
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	ro := &xrecorder.HandlerRecorderObject{}
+
+	go func() {
+		h.handleUDP(context.Background(), server, ro, &testLogger{})
+	}()
+
+	br := bufio.NewReader(client)
+	resp, err := http.ReadResponse(br, nil)
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("got status %d, want %d", resp.StatusCode, http.StatusForbidden)
+	}
+}
+
+func TestHandleUDP_Enabled_NilRouter(t *testing.T) {
+	h := &httpHandler{
+		options: handler.Options{
+			Logger: &testLogger{},
+		},
+	}
+	h.md.proxyAgent = defaultProxyAgent
+	h.md.enableUDP = true
+
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	ro := &xrecorder.HandlerRecorderObject{}
+
+	go func() {
+		// OK response sent, then nil router causes error
+		err := h.handleUDP(context.Background(), server, ro, &testLogger{})
+		if err == nil {
+			t.Log("expected error with nil router for UDP")
+		}
+	}()
+
+	br := bufio.NewReader(client)
+	resp, err := http.ReadResponse(br, nil)
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("got status %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+}