fix(bypass): httpLoader.Close leak, httpPlugin fail-closed, missing Close method

- Add missing httpLoader.Close() in localBypass.Close (was leaking HTTP loader resources)
- Change httpPlugin.Contains to fail-open on errors, matching gRPC plugin
- Add error logging on all httpPlugin error paths (previously silent)
- Add httpPlugin.Close method to drain idle HTTP connections
- Document bypassGroup.Contains whitelist AND / blacklist OR logic

bypass/plugin/http.go

@@ -50,9 +50,9 @@ func NewHTTPPlugin(name string, url string, opts ...plugin.Option) bypass.Bypass
 	}
 }
 
-func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) (ok bool) {
+func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) bool {
 	if p.client == nil {
-		return
+		return true
 	}
 
 	var options bypass.Options
@@ -70,12 +70,14 @@ func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ..
 	}
 	v, err := json.Marshal(&rb)
 	if err != nil {
-		return
+		p.log.Error(err)
+		return true
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.url, bytes.NewReader(v))
 	if err != nil {
-		return
+		p.log.Error(err)
+		return true
 	}
 
 	if p.header != nil {
@@ -84,21 +86,30 @@ func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ..
 	req.Header.Set("Content-Type", "application/json")
 	resp, err := p.client.Do(req)
 	if err != nil {
-		return
+		p.log.Error(err)
+		return true
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return
+		return true
 	}
 
 	res := httpPluginResponse{}
 	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return
+		p.log.Error(err)
+		return true
 	}
 	return res.OK
 }
 
+func (p *httpPlugin) Close() error {
+	if p.client != nil {
+		p.client.CloseIdleConnections()
+	}
+	return nil
+}
+
 func (p *httpPlugin) IsWhitelist() bool {
 	return false
 }