Initial implementation of mc-proxy

Layer 4 TLS SNI proxy with global firewall (IP/CIDR/GeoIP blocking),
per-listener route tables, bidirectional TCP relay with half-close
propagation, and a gRPC admin API (routes, firewall, status) with
TLS/mTLS support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -0,0 +1,36 @@
+.PHONY: build test vet lint proto clean docker all devserver
+
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+
+mc-proxy:
+	go build $(LDFLAGS) -o mc-proxy ./cmd/mc-proxy
+
+build:
+	go build ./...
+
+test:
+	go test ./...
+
+vet:
+	go vet ./...
+
+lint:
+	golangci-lint run ./...
+
+proto:
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/mc-proxy \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/mc-proxy \
+		proto/mc-proxy/v1/*.proto
+
+clean:
+	rm -f mc-proxy
+
+docker:
+	docker build -t mc-proxy -f Dockerfile .
+
+devserver: mc-proxy
+	@mkdir -p srv
+	@if [ ! -f srv/mc-proxy.toml ]; then cp mc-proxy.toml.example srv/mc-proxy.toml; echo "Created srv/mc-proxy.toml from example — edit before running."; fi
+	./mc-proxy server --config srv/mc-proxy.toml
+
+all: vet lint test mc-proxy