test(e2e): docker multi-container gateway e2e for the real forward path

[madeye]

Motivation (audit finding)

The existing e2e runs the proxy + test servers on one host over loopback, via the firewall's OUTPUT/redirect path with --local-traffic. That model structurally cannot exercise the real gateway forwarding path — PREROUTING redirect, FORWARD drop, and UDP TPROXY. As a result the entire SOCKS5 UDP ASSOCIATE QUIC relay (src/udp.rs, added in #46) had zero e2e coverage — its in-code comment even said the TPROXY path "needs a real forwarding/ingress setup and is covered separately."

This PR adds that setup.

What's added

A docker-compose topology (docker/gateway-e2e.yml) with real L3 routing:

client ──lan──> gateway ──wan──> server
10.10.0.3       10.10.0.2         10.20.0.2
                10.20.0.3

• client routes WAN traffic through the gateway and runs the gw_client driver.
• gateway is trans_proxy with a real PREROUTING redirect (TCP) + TPROXY (UDP).
• server is the upstream proxy (SOCKS5 / HTTP CONNECT) + HTTP dest + UDP echo on the WAN side.

scripts/docker_gateway_e2e.sh runs it across two scenarios:

Scenario	TCP	UDP/QUIC
SOCKS5 upstream	proxied	relayed via UDP ASSOCIATE (echo returns)
HTTP CONNECT upstream	proxied	dropped (no echo)

Supporting changes

• test_servers: SOCKS5 server now handles UDP ASSOCIATE (RFC 1928 §7 encap/decap relay); new UDP echo destination; all servers accept a configurable bind address + optional fixed ports via env (defaults preserve the loopback e2e exactly). fwmark gains a generic SO_MARK helper.
• e2e: new gw_client bin (LAN-side driver — asserts the TCP body and the UDP relay/drop); TestServerPorts gains udp_echo_port.
• CI: new E2E Gateway (Docker) job. CLAUDE.md documents the topology.

Verification (local)

• Both docker scenarios pass — UDP relay echo confirmed end-to-end through the gateway (Transparent UDP relay listening on 0.0.0.0:8443 → [PASS] UDP/QUIC relayed).
• The existing loopback e2e still passes 5/5 in a privileged container (no regression from the test_servers/JSON changes).
• cargo fmt --check, cargo clippy --workspace --all-targets -D warnings, cargo test --workspace (169) clean on macOS; -D warnings Linux cross-build clean.

🤖 Generated with Claude Code