Initial implementation of mc-proxy

Layer 4 TLS SNI proxy with global firewall (IP/CIDR/GeoIP blocking),
per-listener route tables, bidirectional TCP relay with half-close
propagation, and a gRPC admin API (routes, firewall, status) with
TLS/mTLS support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/mc-proxy.toml.example

@@ -0,0 +1,37 @@
+# mc-proxy configuration
+
+# Listeners. Each entry binds a TCP listener on the specified address.
+[[listeners]]
+addr = ":443"
+
+[[listeners]]
+addr = ":8443"
+
+[[listeners]]
+addr = ":9443"
+
+# Routes. SNI hostname → backend address.
+[[routes]]
+hostname = "metacrypt.metacircular.net"
+backend  = "127.0.0.1:18443"
+
+[[routes]]
+hostname = "mcias.metacircular.net"
+backend  = "127.0.0.1:28443"
+
+# Firewall. Global blocklist, evaluated before routing. Default allow.
+[firewall]
+geoip_db          = "/srv/mc-proxy/GeoLite2-Country.mmdb"
+blocked_ips       = []
+blocked_cidrs     = []
+blocked_countries = ["KP", "CN", "IN", "IL"]
+
+# Proxy behavior.
+[proxy]
+connect_timeout  = "5s"
+idle_timeout     = "300s"
+shutdown_timeout = "30s"
+
+# Logging.
+[log]
+level = "info"