feat: Add L7 HTTP reverse proxy mode to HAProxy

Extend HAProxy config generation to support L7 HTTP routes alongside
existing L4 SNI passthrough routes. This enables Wild Works services
to be reverse-proxied with TLS termination by Central while Wild Cloud
k8s instances continue using L4 SNI passthrough.

- Add HTTPRoute type: domain, backend address, optional health path
- Add GenerateWithOpts for full config options (HTTP routes, wildcard cert)
- L4 SNI frontend routes known Cloud domains to k8s LBs; unknown SNIs
  fall through to L7 TLS-termination frontend for Host-based routing
- L7 frontend terminates TLS with wildcard cert, routes by Host header
- Health check support via HAProxy httpchk
- Backward compatible: existing Generate() works unchanged
- 3 new tests (L7-only, mixed L4+L7, backward compat)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/haproxy/config_test.go

@@ -194,3 +194,99 @@ func TestGenerate_CustomRoute(t *testing.T) {
 		t.Errorf("expected server line with backend address, got:\n%s", out)
 	}
 }
+
+// --- L7 HTTP route tests ---
+
+func TestGenerateWithOpts_HTTPRoutes_L7Frontend(t *testing.T) {
+	m := NewManager("")
+	httpRoutes := []HTTPRoute{
+		{Name: "my-api", Domain: "my-api.payne.io", Backend: "192.168.8.60:9001", HealthPath: "/health"},
+		{Name: "dashboard", Domain: "dashboard.payne.io", Backend: "192.168.8.60:8080"},
+	}
+
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{
+		HTTPRoutes:   httpRoutes,
+		WildcardCert: "/etc/haproxy/certs/wildcard.pem",
+	})
+
+	// L7 TLS termination frontend should exist
+	if !strings.Contains(out, "frontend l7_https") {
+		t.Errorf("expected L7 frontend, got:\n%s", out)
+	}
+	if !strings.Contains(out, "ssl crt /etc/haproxy/certs/wildcard.pem") {
+		t.Errorf("expected wildcard cert in L7 bind, got:\n%s", out)
+	}
+
+	// Host-based ACLs
+	if !strings.Contains(out, "hdr(host) -i my-api.payne.io") {
+		t.Errorf("expected Host ACL for my-api, got:\n%s", out)
+	}
+	if !strings.Contains(out, "hdr(host) -i dashboard.payne.io") {
+		t.Errorf("expected Host ACL for dashboard, got:\n%s", out)
+	}
+
+	// L7 backends
+	if !strings.Contains(out, "backend be_l7_my_api") {
+		t.Errorf("expected L7 backend for my-api, got:\n%s", out)
+	}
+	if !strings.Contains(out, "server s0 192.168.8.60:9001 check") {
+		t.Errorf("expected my-api server with health check, got:\n%s", out)
+	}
+	if !strings.Contains(out, "option httpchk GET /health") {
+		t.Errorf("expected httpchk for my-api, got:\n%s", out)
+	}
+
+	// Dashboard backend (no health check)
+	if !strings.Contains(out, "backend be_l7_dashboard") {
+		t.Errorf("expected L7 backend for dashboard, got:\n%s", out)
+	}
+	if !strings.Contains(out, "server s0 192.168.8.60:8080") {
+		t.Errorf("expected dashboard server line, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_MixedL4AndL7(t *testing.T) {
+	m := NewManager("")
+	instances := []InstanceRoute{
+		{Name: "payne-cloud", Domain: "cloud.payne.io", BackendIP: "192.168.8.100"},
+	}
+	httpRoutes := []HTTPRoute{
+		{Name: "my-api", Domain: "my-api.payne.io", Backend: "192.168.8.60:9001"},
+	}
+
+	out := m.GenerateWithOpts(instances, nil, GenerateOpts{
+		HTTPRoutes: httpRoutes,
+	})
+
+	// Both L4 SNI route and L7 route should be in the same config
+	if !strings.Contains(out, "use_backend be_https_payne_cloud if is_payne_cloud") {
+		t.Errorf("expected L4 instance route, got:\n%s", out)
+	}
+	if !strings.Contains(out, "frontend l7_https") {
+		t.Errorf("expected L7 frontend, got:\n%s", out)
+	}
+	if !strings.Contains(out, "backend be_l7_my_api") {
+		t.Errorf("expected L7 backend for my-api, got:\n%s", out)
+	}
+	// L7 fallback should be present
+	if !strings.Contains(out, "default_backend be_l7_termination") {
+		t.Errorf("expected default_backend for L7 termination, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_BackwardCompatible(t *testing.T) {
+	m := NewManager("")
+	instances := []InstanceRoute{
+		{Name: "test", Domain: "test.example.com", BackendIP: "10.0.0.1"},
+	}
+
+	// Using old Generate function should still work
+	out := m.Generate(instances, nil)
+	if !strings.Contains(out, "be_https_test") {
+		t.Errorf("backward compat: expected instance backend, got:\n%s", out)
+	}
+	// No L7 frontend when no HTTP routes
+	if strings.Contains(out, "frontend l7_https") {
+		t.Errorf("backward compat: unexpected L7 frontend, got:\n%s", out)
+	}
+}