docs(bypass): add package and symbol doc comments

Add Go doc comments for all exported symbols, option functions, and
internal types across the bypass package and plugin sub-package,
following the style of the admission package.

bypass/plugin/grpc.go

@@ -1,3 +1,6 @@
+// Package bypass implements plugin-based Bypass using gRPC and HTTP
+// transports. Plugins delegate bypass decisions to an external process
+// or service.
 package bypass
 
 import (
@@ -12,13 +15,18 @@ import (
 	"google.golang.org/grpc"
 )
 
+// grpcPlugin delegates bypass decisions to a remote gRPC service.
+// If the connection fails or the client is nil, all addresses bypass
+// the proxy (fail-open).
 type grpcPlugin struct {
 	conn   grpc.ClientConnInterface
 	client proto.BypassClient
 	log    logger.Logger
 }
 
-// NewGRPCPlugin creates a Bypass plugin based on gRPC.
+// NewGRPCPlugin creates a Bypass that delegates decisions to a gRPC
+// bypass service at addr. On connection failure, the plugin logs the
+// error and returns a fail-open instance (all addresses bypass).
 func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) bypass.Bypass {
 	var options plugin.Options
 	for _, opt := range opts {

bypass/plugin/http.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-gost/x/internal/plugin"
 )
 
+// httpPluginRequest is the JSON payload sent to a remote HTTP bypass service.
 type httpPluginRequest struct {
 	Service string `json:"service"`
 	Network string `json:"network"`
@@ -21,10 +22,14 @@ type httpPluginRequest struct {
 	Path    string `json:"path"`
 }
 
+// httpPluginResponse is the JSON response from a remote HTTP bypass service.
 type httpPluginResponse struct {
 	OK bool `json:"ok"`
 }
 
+// httpPlugin delegates bypass decisions to a remote HTTP service.
+// All error paths return true (fail-open) so that a down plugin
+// does not block traffic.
 type httpPlugin struct {
 	url    string
 	client *http.Client
@@ -32,7 +37,9 @@ type httpPlugin struct {
 	log    logger.Logger
 }
 
-// NewHTTPPlugin creates an Bypass plugin based on HTTP.
+// NewHTTPPlugin creates a Bypass that delegates decisions to an HTTP
+// bypass service at url. The service should accept POST requests with
+// a JSON body and return {"ok": true/false}.
 func NewHTTPPlugin(name string, url string, opts ...plugin.Option) bypass.Bypass {
 	var options plugin.Options
 	for _, opt := range opts {