Add L7 and PROXY protocol fields to gRPC API and CLI

Proto: Route message gains mode, tls_cert, tls_key, backend_tls,
send_proxy_protocol fields. ListenerStatus gains proxy_protocol.
Generated code regenerated with protoc v29.5.

gRPC server: AddRoute validates mode ("l4"/"l7", defaults to "l4"),
requires tls_cert/tls_key for L7 routes, persists all fields via
write-through. ListRoutes returns full route info. GetStatus
includes proxy_protocol on listener status.

Client package: Route struct expanded with Mode, TLSCert, TLSKey,
BackendTLS, SendProxyProtocol. AddRoute signature changed to accept
a Route struct instead of individual hostname/backend strings.
ListenerStatus gains ProxyProtocol. ListRoutes maps all proto fields.

mcproxyctl: routes add gains --mode, --tls-cert, --tls-key,
--backend-tls, --send-proxy-protocol flags. routes list displays
mode and option tags for each route.

New tests: add L7 route via gRPC with field round-trip verification,
L7 route missing cert/key (InvalidArgument), invalid mode rejection,
default-to-L4 backward compatibility, proxy_protocol in status.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcproxyctl/routes.go

@@ -6,6 +6,8 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
+
+	mcproxy "git.wntrmute.dev/kyle/mc-proxy/client/mcproxy"
 )
 
 func routesCmd() *cobra.Command {
@@ -45,7 +47,7 @@ func routesListCmd() *cobra.Command {
 				return nil
 			}
 
-			// Find max hostname length for alignment
+			// Find max hostname length for alignment.
 			maxHostLen := 0
 			for _, r := range routes {
 				if len(r.Hostname) > maxHostLen {
@@ -55,7 +57,18 @@ func routesListCmd() *cobra.Command {
 
 			fmt.Printf("Routes for %s:\n", listenerAddr)
 			for _, r := range routes {
-				fmt.Printf("  %-*s  ->  %s\n", maxHostLen, r.Hostname, r.Backend)
+				mode := r.Mode
+				if mode == "" {
+					mode = "l4"
+				}
+				extra := ""
+				if r.SendProxyProtocol {
+					extra += " [proxy-protocol]"
+				}
+				if r.BackendTLS {
+					extra += " [backend-tls]"
+				}
+				fmt.Printf("  %-*s  ->  %-25s  [%s]%s\n", maxHostLen, r.Hostname, r.Backend, mode, extra)
 			}
 
 			return nil
@@ -64,7 +77,15 @@ func routesListCmd() *cobra.Command {
 }
 
 func routesAddCmd() *cobra.Command {
-	return &cobra.Command{
+	var (
+		mode              string
+		tlsCert           string
+		tlsKey            string
+		backendTLS        bool
+		sendProxyProtocol bool
+	)
+
+	cmd := &cobra.Command{
 		Use:   "add LISTENER HOSTNAME BACKEND",
 		Short: "Add a route",
 		Long:  "Add a route mapping a hostname to a backend for the specified listener.",
@@ -78,14 +99,31 @@ func routesAddCmd() *cobra.Command {
 			ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
 			defer cancel()
 
-			if err := client.AddRoute(ctx, listenerAddr, hostname, backend); err != nil {
+			route := mcproxy.Route{
+				Hostname:          hostname,
+				Backend:           backend,
+				Mode:              mode,
+				TLSCert:           tlsCert,
+				TLSKey:            tlsKey,
+				BackendTLS:        backendTLS,
+				SendProxyProtocol: sendProxyProtocol,
+			}
+			if err := client.AddRoute(ctx, listenerAddr, route); err != nil {
 				return fmt.Errorf("adding route: %w", err)
 			}
 
-			fmt.Printf("Added route: %s -> %s on %s\n", hostname, backend, listenerAddr)
+			fmt.Printf("Added route: %s -> %s on %s [%s]\n", hostname, backend, listenerAddr, mode)
 			return nil
 		},
 	}
+
+	cmd.Flags().StringVar(&mode, "mode", "l4", "route mode: l4 (passthrough) or l7 (TLS-terminating)")
+	cmd.Flags().StringVar(&tlsCert, "tls-cert", "", "TLS certificate path (L7 only)")
+	cmd.Flags().StringVar(&tlsKey, "tls-key", "", "TLS private key path (L7 only)")
+	cmd.Flags().BoolVar(&backendTLS, "backend-tls", false, "re-encrypt to backend (L7 only)")
+	cmd.Flags().BoolVar(&sendProxyProtocol, "send-proxy-protocol", false, "send PROXY v2 header to backend")
+
+	return cmd
 }
 
 func routesRemoveCmd() *cobra.Command {