Transparent proxy mode (#823)

Adds a **transparent TCP proxy mode** to zenserver (activated via `zenserver proxy`), allowing it to sit between clients and upstream Zen servers to inspect and monitor HTTP/1.x traffic in real time. Primarily useful during development, to be able to observe multi-server/client interactions in one place.

- **Dedicated proxy port** -- Proxy mode defaults to port 8118 with its own data directory to avoid collisions with a normal zenserver instance.
- **TCP proxy core** (`src/zenserver/proxy/`) -- A new transparent TCP proxy that forwards connections to upstream targets, with support for both TCP/IP and Unix socket listeners. Multi-threaded I/O for connection handling. Supports Unix domain sockets for both upstream/downstream.
- **HTTP traffic inspection** -- Parses HTTP/1.x request/response streams inline to extract method, path, status, content length, and WebSocket upgrades without breaking the proxied data.
- **Proxy dashboard** -- A web UI showing live connection stats, per-target request counts, active connections, bytes transferred, and client IP/session ID rollups.
- **Server mode display** -- Dashboard banner now shows the running server mode (Zen Proxy, Zen Compute, etc.).

Supporting changes included in this branch:

- **Wildcard log level matching** -- Log levels can now be set per-category using wildcard patterns (e.g. `proxy.*=debug`).
- **`zen down --all`** -- New flag to shut down all running zenserver instances; also used by the new `xmake kill` task.
- Minor test stability fixes (flaky hash collisions, per-thread RNG seeds).
- Support ZEN_MALLOC environment variable for default allocator selection and switch default to rpmalloc
- Fixed sentry-native build to allow LTO on Windows

1 files changed, 9 insertions, 2 deletions

diff --git a/src/zenstore/compactcas.cpp b/src/zenstore/compactcas.cpp
index b09892687..43dc389e2 100644
--- a/src/zenstore/compactcas.cpp
+++ b/src/zenstore/compactcas.cpp
@@ -1929,19 +1929,26 @@ TEST_CASE("compactcas.restart")
 		ValidateChunks(Cas, Hashes, true);
 		if (true)
 		{
-			std::vector<IoHash> DropHashes;
-			std::vector<IoHash> KeepHashes;
+			std::vector<IoHash>					   DropHashes;
+			std::vector<IoHash>					   KeepHashes;
+			tsl::robin_set<IoHash, IoHash::Hasher> KeepSet;
 			for (size_t Index = 0; Index < Hashes.size(); Index++)
 			{
 				if (Index % 5 == 0)
 				{
 					KeepHashes.push_back(Hashes[Index]);
+					KeepSet.insert(Hashes[Index]);
 				}
 				else
 				{
 					DropHashes.push_back(Hashes[Index]);
 				}
 			}
+			// Remove any hash from DropHashes that also appears in KeepHashes.
+			// CreateSemiRandomBlob uses a thread_local PRNG with a fixed seed,
+			// so different GenerateChunks calls can produce duplicate hashes
+			// when threads hit the same PRNG state with the same blob size.
+			std::erase_if(DropHashes, [&KeepSet](const IoHash& H) { return KeepSet.contains(H); });
 			//			std::span<const IoHash> KeepHashes(Hashes);
 			//			ZEN_ASSERT(ExpectedGcCount < Hashes.size());
 			//			KeepHashes = KeepHashes.subspan(ExpectedGcCount);