Surface ACL-denied status on the forwarding path (502 -> 403)

Not from the ultrareview — found while verifying the review fixes. On the
non-CONNECT proxy-forwarding path, the ACL check runs inside
httpTransport's DialContext, so a denial (e.g. caddyhttp.Error(403, ...))
comes back from RoundTrip wrapped in a transport error rather than as a
bare HandlerError. The error check used a non-unwrapping type assertion
(err.(caddyhttp.HandlerError)), which failed on the wrapped error and fell
through to a blanket 502 — so an operator's ACL block surfaced to the
client as "502 Bad Gateway" instead of "403 Forbidden". The request was
still blocked (no leak); only the status code was wrong.

Use errors.As to unwrap so the underlying HandlerError's status reaches
the client. The CONNECT path was already correct (it returns the ACL
error directly). Fixes TestWhitelistBlocking, TestLocalNetworksDefault-
Forbidden, and TestBlacklistBlocking (the last requires an environment
without an HTTP_PROXY env var, since http.ProxyFromEnvironment otherwise
routes the forwarded request through the proxy and the per-IP ACL never
sees the target IP).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aUsernameWoW

forwardproxy.go

@@ -502,8 +502,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht
 		defer response.Body.Close()
 	}
 	if err != nil {
-		if _, ok := err.(caddyhttp.HandlerError); ok {
-			return err
+		// The ACL check runs inside httpTransport's DialContext, so a denial
+		// (e.g. 403) comes back wrapped in a transport error rather than as a
+		// bare HandlerError. Unwrap with errors.As so the operator's status
+		// reaches the client instead of a blanket 502.
+		var handlerErr caddyhttp.HandlerError
+		if errors.As(err, &handlerErr) {
+			return handlerErr
 		}
 		return caddyhttp.Error(http.StatusBadGateway,
 			fmt.Errorf("failed to read response: %v", err))