fix(plugin): CloseIdleConnections silent no-op when tokenTransport wraps HTTP transport

tokenTransport now delegates CloseIdleConnections to the underlying
*http.Transport so http.Client.CloseIdleConnections() works through
the wrapper. Three plugin Close() methods updated to unwrap via
HTTPClientTransport before calling CloseIdleConnections.

RoundTrip now short-circuits when caller already set Authorization,
avoiding an unnecessary req.Clone allocation on the pass-through path.

bypass/plugin/http.go

@@ -117,7 +117,9 @@ func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ..
 
 func (p *httpPlugin) Close() error {
 	if p.client != nil {
-		p.client.CloseIdleConnections()
+		if tr := plugin.HTTPClientTransport(p.client); tr != nil {
+			tr.CloseIdleConnections()
+		}
 	}
 	return nil
 }