[shizukunacho]

WHY

After an HTTP route is unregistered and registered again with a new backend, HTTPReverseProxy can send new requests through the old backend's idle connection. The transport reuse key contains the domain, location, HTTP user and endpoint, which remain identical across registrations. A real HTTP regression reproduces this even when every frontend request uses a fresh TCP connection: replacing backend A with B still returns A.

Give each successful route registration a unique ID and include it in the transport reuse key. Match the route once per request and use that same configuration for authentication, rewriting and dialing, including CONNECT. This also prevents a route replacement between authentication and dialing from selecting the new backend under the old request policy. Connections remain reusable within an unchanged registration.

Two regression tests fail before the change and pass afterward. They cover backend replacement, continued connection reuse within a registration, and a deterministic replacement after authentication but before dialing. The latter also verifies that subsequent requests use the replacement credentials.

Validation on Windows/amd64 with Go 1.26.11:

• go test ./pkg/util/vhost -count=1
• go test -race ./pkg/util/vhost -count=1
• go vet ./pkg/util/vhost
• go test -tags noweb ./server/group ./server/proxy -count=1
• go vet -tags noweb ./server/group ./server/proxy
• gofmt and git diff --check

The full end-to-end suite was not run locally. This change concerns route unregistration and re-registration.

Draft while #5612 remains open, in accordance with the repository's one non-draft PR limit.