fix(learner): SPA proxy forwards no credentials and never goes through HTTP_PROXY

spaWithCsp proxies GET and HEAD only (405 otherwise, no body buffering) and forwards only accept,
if-none-match, if-modified-since and range. The internal server listens on a Unix socket in a private
0700 temp dir. Bun 1.3.14 ignores proxy: false for this hop, and over a socket with a proxy set it sends
an absolute-form target that breaks asset routing, so localhost, 127.0.0.1 and ::1 are appended to
NO_PROXY/no_proxy (existing entries kept). accept-encoding is no longer forced; fetch decompresses and
the encoding headers are dropped.

Test: in a subprocess with HTTP(S)_PROXY and ALL_PROXY set to a dead proxy, the SPA and an asset load
with the CSP, POST gets 405, and the upstream sees no Cookie, Authorization or X-Forwarded-For.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-learner/test/e2e/spa-proxy-check.ts

@@ -0,0 +1,77 @@
+// Run by spa.test.ts in a subprocess with HTTP_PROXY/ALL_PROXY pointing at an unreachable proxy.
+import { spaWithCsp } from "../../src/server/spa";
+
+/**
+ * The test client speaks raw HTTP/1.1 over Bun.connect: fetch and Bun's node:http both honour HTTP_PROXY, and
+ * only the code under test should meet the proxy.
+ */
+async function get(url: string, method = "GET", headers: Record<string, string> = {}): Promise<{ status: number; headers: Record<string, string>; body: string }> {
+  const u = new URL(url);
+  let raw = "";
+  await new Promise<void>((resolve, reject) => {
+    Bun.connect({
+      hostname: u.hostname, port: Number(u.port),
+      socket: {
+        open(sock) {
+          const body = method === "POST" ? "x" : "";
+          const lines = [`${method} ${u.pathname}${u.search} HTTP/1.1`, `Host: ${u.host}`, "Connection: close", ...Object.entries(headers).map(([k, v]) => `${k}: ${v}`)];
+          if (body) lines.push(`Content-Length: ${body.length}`);
+          sock.write(`${lines.join("\r\n")}\r\n\r\n${body}`);
+        },
+        data(sock, d) {
+          raw += new TextDecoder().decode(d);
+          // Bun keeps the connection open despite "Connection: close"; stop once the whole response is here.
+          const end = raw.indexOf("\r\n\r\n");
+          if (end < 0) return;
+          const len = /\r\ncontent-length:\s*(\d+)/i.exec(raw.slice(0, end));
+          const done = len ? raw.length - end - 4 >= Number(len[1]) : /\r\n0\r\n\r\n$/.test(raw);
+          if (done) { sock.end(); resolve(); }
+        },
+        close() { resolve(); },
+        error(_s, e) { reject(e); },
+      },
+    }).catch(reject);
+  });
+  const [head, ...rest] = raw.split("\r\n\r\n");
+  const [statusLine, ...hl] = head!.split("\r\n");
+  const hs = Object.fromEntries(hl.map((l) => [l.slice(0, l.indexOf(":")).toLowerCase(), l.slice(l.indexOf(":") + 1).trim()]));
+  let body = rest.join("\r\n\r\n");
+  if (hs["transfer-encoding"] === "chunked") {
+    let out = "", i = 0;
+    for (;;) { const nl = body.indexOf("\r\n", i); const n = parseInt(body.slice(i, nl), 16); if (!n) break; out += body.slice(nl + 2, nl + 2 + n); i = nl + 2 + n + 2; }
+    body = out;
+  }
+  return { status: Number(statusLine!.split(" ")[1]), headers: hs, body };
+}
+
+// Control, before spaWithCsp touches NO_PROXY: a plain loopback fetch in this process goes to the env proxy.
+const plain = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: () => new Response("direct") });
+const controlViaEnvProxy = await fetch(`http://127.0.0.1:${plain.port}/`, { signal: AbortSignal.timeout(2000) }).then((r) => `status ${r.status}`, (e) => `error ${(e as Error).name}`);
+plain.stop(true);
+
+const seen: Record<string, string | null>[] = [];
+const DOC = '<!doctype html><html><head><script type="module" src="/app.js"></script></head><body><div id="root"></div></body></html>';
+const spa = spaWithCsp((req) => {
+  if (new URL(req.url).pathname === "/app.js") return new Response("console.log(1)", { headers: { "Content-Type": "text/javascript" } });
+  seen.push({ cookie: req.headers.get("cookie"), authorization: req.headers.get("authorization"), xff: req.headers.get("x-forwarded-for"), accept: req.headers.get("accept") });
+  return new Response(DOC, { headers: { "Content-Type": "text/html;charset=utf-8" } });
+}, { development: false });
+const server = Bun.serve({ hostname: "127.0.0.1", port: 0, routes: spa.routes });
+const url = `http://127.0.0.1:${server.port}/c/sample`;
+const out: Record<string, unknown> = {};
+try {
+  out.controlViaEnvProxy = controlViaEnvProxy;
+  const r = await get(url, "GET", { cookie: "better-auth.session_token=secret", authorization: "Bearer secret", "x-forwarded-for": "1.2.3.4", accept: "text/html" });
+  out.status = r.status;
+  out.csp = r.headers["content-security-policy"];
+  out.body = r.body;
+  out.post = (await get(url, "POST")).status;
+  const asset = await get(`http://127.0.0.1:${server.port}/app.js`);
+  out.asset = `${asset.status} ${asset.headers["content-type"]} ${asset.body}`;
+  out.noProxy = process.env.NO_PROXY;
+  out.seen = seen;
+} finally {
+  server.stop(true);
+  spa.stop();
+}
+console.log(JSON.stringify(out));