feat(audit): finalize incomplete http requests

[P4ST4S]

Summary

Complete terminal audit finalization for HTTP requests that do not receive and deliver a normal JSON-RPC response.

Accepted operations now receive one terminal outcome for upstream connection failures, timeouts, malformed or incomplete responses, SSE failures, request cancellation, and client disconnects.

Context

Implements the HTTP portion of #69. Together with #77, this completes the issue scope.

Stacked on #74 only.

Approach

• finalize all accepted calls when the upstream request fails
• distinguish timeout, client_disconnect, cancelled, and upstream_error from context and transport errors
• classify missing or malformed successful responses as malformed_upstream_response
• classify non-success HTTP responses without a matching JSON-RPC result as upstream_error
• finalize incomplete SSE streams and client streaming failures
• retain pending HTTP notifications until the upstream request completes, instead of recording premature success
• remove finalized operations from pending state before any late response can be observed

Forwarding behavior is unchanged. Audit inspection and storage failures remain separately logged and never replace or drop the proxied message.

Test plan

• go test -race ./internal/proxy/... ./internal/audit/...
• go test -race ./...
• go build ./...
• go vet ./...

All commands pass.

Tests cover connection refusal, upstream timeout, client cancellation, malformed response bodies, incomplete SSE, client write failure, and failed notifications.

Stability impact

No existing field or JSON-RPC error-code semantics change. The additive outcome and audit_operation_id fields introduced by #74 are now populated on HTTP failure paths that previously produced no terminal audit entry.

HTTP notifications are now recorded only after the upstream result is known, preventing a false success audit event when forwarding fails.

Notes for reviewer

The stdio and HTTP work are deliberately separate review units. #77 contains the corresponding stdio lifecycle changes.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 71.42857% with 18 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/proxy/http.go	71.42%	13 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!