refactor(server): replace rawHTTPResponseWriter with stdlib http.Server

- Rewrite server to use net/http.Server with ServeHTTP handler instead
  of raw TCP listener with hand-written HTTP responses. Control plane
  errors now get proper Content-Type, Content-Length, and chunked
  encoding via http.Error(). Tunnel traffic hijacks the connection and
  re-serializes the request for forwarding.
- Simplify reconstructedConn to accept variative io.Readers
- Delete raw_http_response_writer.go (no longer needed)
- Fix TCP forwarder: bare host:port (e.g. "127.0.0.1:5432") now works
  correctly instead of failing on url.Parse. Only HTTP/HTTPS schemes
  go through URL parsing; everything else is treated as raw TCP.
- Add 8 new e2e tests: HTTP response quality, 1MB response body, 512KB
  request body, TCP echo, TCP large payload, concurrent single-tunnel,
  concurrent multi-tunnel (16 tests total, all passing)

tunnel/forwarder.go

@@ -21,23 +21,15 @@ type Forwarder interface {
 }
 
 func NewForwarder(target string, tunnelStore store.TunnelStore) (Forwarder, error) {
-	// Get Target URL
+	// Only parse as URL for HTTP targets. Bare host:port (e.g., "127.0.0.1:5432")
+	// is not a valid URL and should be treated as a raw TCP target.
 	targetURL, err := url.Parse(target)
-	if err != nil {
-		return nil, err
-	}
-
-	// Get Connection Builder
-	var forwarder Forwarder
-	switch targetURL.Scheme {
-	case "http", "https":
-		forwarder, err = newHTTPForwarder(targetURL, tunnelStore)
-		if err != nil {
-			return nil, err
+	if err == nil {
+		switch targetURL.Scheme {
+		case "http", "https":
+			return newHTTPForwarder(targetURL, tunnelStore)
 		}
-	default:
-		forwarder = newTCPForwarder(target, tunnelStore)
 	}
 
-	return forwarder, nil
+	return newTCPForwarder(target, tunnelStore), nil
 }