Transparent proxy mode (#823)

Adds a **transparent TCP proxy mode** to zenserver (activated via `zenserver proxy`), allowing it to sit between clients and upstream Zen servers to inspect and monitor HTTP/1.x traffic in real time. Primarily useful during development, to be able to observe multi-server/client interactions in one place.

- **Dedicated proxy port** -- Proxy mode defaults to port 8118 with its own data directory to avoid collisions with a normal zenserver instance.
- **TCP proxy core** (`src/zenserver/proxy/`) -- A new transparent TCP proxy that forwards connections to upstream targets, with support for both TCP/IP and Unix socket listeners. Multi-threaded I/O for connection handling. Supports Unix domain sockets for both upstream/downstream.
- **HTTP traffic inspection** -- Parses HTTP/1.x request/response streams inline to extract method, path, status, content length, and WebSocket upgrades without breaking the proxied data.
- **Proxy dashboard** -- A web UI showing live connection stats, per-target request counts, active connections, bytes transferred, and client IP/session ID rollups.
- **Server mode display** -- Dashboard banner now shows the running server mode (Zen Proxy, Zen Compute, etc.).

Supporting changes included in this branch:

- **Wildcard log level matching** -- Log levels can now be set per-category using wildcard patterns (e.g. `proxy.*=debug`).
- **`zen down --all`** -- New flag to shut down all running zenserver instances; also used by the new `xmake kill` task.
- Minor test stability fixes (flaky hash collisions, per-thread RNG seeds).
- Support ZEN_MALLOC environment variable for default allocator selection and switch default to rpmalloc
- Fixed sentry-native build to allow LTO on Windows

2 files changed, 39 insertions, 13 deletions

diff --git a/src/zenserver/config/config.cpp b/src/zenserver/config/config.cpp
index ef9c6b7b8..858225032 100644
--- a/src/zenserver/config/config.cpp
+++ b/src/zenserver/config/config.cpp
@@ -18,6 +18,9 @@
 #include <zencore/string.h>
 #include <zenutil/config/commandlineoptions.h>
 #include <zenutil/config/environmentoptions.h>
+#include <zenutil/consoletui.h>
+
+#include <charconv>
 
 ZEN_THIRD_PARTY_INCLUDES_START
 #include <fmt/format.h>
@@ -197,6 +200,7 @@ struct ZenServerCmdLineOptions
 	std::string DataDir;
 	std::string BaseSnapshotDir;
 	std::string SecurityConfigPath;
+	std::string PortStr;
 
 	ZenLoggingCmdLineOptions LoggingOptions;
 
@@ -301,7 +305,7 @@ ZenServerCmdLineOptions::AddCliOptions(cxxopts::Options& options, ZenServerConfi
 					   "p",
 					   "port",
 					   "Select HTTP port",
-					   cxxopts::value<int>(ServerOptions.BasePort)->default_value("8558"),
+					   cxxopts::value<std::string>(PortStr)->default_value("auto"),
 					   "<port number>");
 
 	options.add_option("network",
@@ -468,6 +472,18 @@ ZenServerCmdLineOptions::ApplyOptions(cxxopts::Options& options, ZenServerConfig
 	ServerOptions.BaseSnapshotDir	 = MakeSafeAbsolutePath(BaseSnapshotDir);
 	ServerOptions.SecurityConfigPath = MakeSafeAbsolutePath(SecurityConfigPath);
 
+	if (PortStr != "auto")
+	{
+		int Port	   = 0;
+		auto [Ptr, Ec] = std::from_chars(PortStr.data(), PortStr.data() + PortStr.size(), Port);
+		if (Ec != std::errc{} || Ptr != PortStr.data() + PortStr.size() || Port <= 0 || Port > 65535)
+		{
+			throw OptionParseException(fmt::format("invalid port '{}': expected 'auto' or a number between 1 and 65535", PortStr),
+									   options.help());
+		}
+		ServerOptions.BasePort = Port;
+	}
+
 	LoggingOptions.ApplyOptions(ServerOptions.LoggingConfig);
 
 #if ZEN_WITH_HTTPSYS
@@ -545,6 +561,7 @@ ZenServerConfiguratorBase::Configure(int argc, char* argv[])
 	}
 
 	cxxopts::Options options("zenserver", "Zen Storage Server");
+	options.set_width(TuiConsoleColumns(80));
 
 	ZenServerCmdLineOptions BaseOptions;
 	BaseOptions.AddCliOptions(options, m_ServerOptions);
@@ -609,6 +626,14 @@ ZenServerConfiguratorBase::Configure(int argc, char* argv[])
 		}
 
 		ValidateOptions();	// subclass validation
+
+		// Resolve auto port: subclass ValidateOptions may have set a
+		// mode-specific default; if BasePort is still 0, fall back to the
+		// global default.
+		if (m_ServerOptions.BasePort == 0)
+		{
+			m_ServerOptions.BasePort = ZenServerConfig::kDefaultBasePort;
+		}
 	}
 	catch (const OptionParseException& e)
 	{
diff --git a/src/zenserver/config/config.h b/src/zenserver/config/config.h
index 88226f810..e481c7225 100644
--- a/src/zenserver/config/config.h
+++ b/src/zenserver/config/config.h
@@ -50,18 +50,19 @@ struct ZenServerConfig
 	ZenSentryConfig		  SentryConfig;
 	ZenStatsConfig		  StatsConfig;
 	ZenLoggingConfig	  LoggingConfig;
-	int					  BasePort	   = 8558;	// Service listen port (used for both UDP and TCP)
-	int					  OwnerPid	   = 0;		// Parent process id (zero for standalone)
-	bool				  IsDebug	   = false;
-	bool				  IsCleanStart = false;	 // Indicates whether all state should be wiped on startup or not
-	bool				  IsPowerCycle = false;	 // When true, the process shuts down immediately after initialization
-	bool				  IsTest	   = false;
-	bool				  Detach	   = true;	// Whether zenserver should detach from existing process group (Mac/Linux)
-	int					  CoreLimit	   = 0;		// If set, hardware concurrency queries are capped at this number
-	int					  LieCpu	   = 0;
-	bool				  IsDedicated  = false;	 // Indicates a dedicated/shared instance, with larger resource requirements
-	bool				  ShouldCrash  = false;	 // Option for testing crash handling
-	bool				  IsFirstRun   = false;
+	static constexpr int  kDefaultBasePort = 8558;
+	int					  BasePort		   = 0;	 // Service listen port; 0 = auto (resolved per mode)
+	int					  OwnerPid		   = 0;	 // Parent process id (zero for standalone)
+	bool				  IsDebug		   = false;
+	bool				  IsCleanStart	   = false;	 // Indicates whether all state should be wiped on startup or not
+	bool				  IsPowerCycle	   = false;	 // When true, the process shuts down immediately after initialization
+	bool				  IsTest		   = false;
+	bool				  Detach		   = true;	// Whether zenserver should detach from existing process group (Mac/Linux)
+	int					  CoreLimit		   = 0;		// If set, hardware concurrency queries are capped at this number
+	int					  LieCpu		   = 0;
+	bool				  IsDedicated	   = false;	 // Indicates a dedicated/shared instance, with larger resource requirements
+	bool				  ShouldCrash	   = false;	 // Option for testing crash handling
+	bool				  IsFirstRun	   = false;
 	std::filesystem::path ConfigFile;		   // Path to Lua config file
 	std::filesystem::path SystemRootDir;	   // System root directory (used for machine level config)
 	std::filesystem::path ContentDir;		   // Root directory for serving frontend content (experimental)