fix(proxy): refuse method-override headers; add GCP observability curl example

[paveq]

Why

Proxy tools (#8) have no example under examples/. While checking the route rules for one, I found that Google APIs route by X-HTTP-Method-Override. That header let a request get past the proxy's method rules. This PR fixes that bypass and adds the example.

1. Fix: refuse method-override headers (src/proxy/server.rs)

Route rules match the method on the request line. Google front ends use X-HTTP-Method-Override instead when it is present, on GET and POST. Checked against logging.googleapis.com:

Request	Status	Meaning
GET /v2/entries:list	404	no GET method on this path
GET /v2/entries:list + X-HTTP-Method-Override: POST	403	routed to the POST method, auth required
POST /v2/projects/x/logs/y	404	no POST method on this path
POST /v2/projects/x/logs/y + X-HTTP-Method-Override: DELETE	403	routed to logs.delete

So the README's own example, deny = ["DELETE /**"], did not stop POST + X-HTTP-Method-Override: DELETE. A GET /…/** allow rule also let writes through.

vet_request now returns 403 when X-HTTP-Method-Override, X-HTTP-Method or X-Method-Override is present, whatever its value. The proxy refuses the request instead of stripping the header. Stripping would forward a different request than the tool sent, while a clear 403 tells the agent to use -X.

Not covered: frameworks (Laravel, Symfony, Rails) that read _method from a POST's form body or query string. The proxy doesn't parse bodies. SECURITY.md lists this under residual risks.

Docs: the SECURITY.md refusal table and residual risks, a SKILL.md rule for agents, the README rules section, and the flow diagram in docs/proxy-tools-design.md.

2. Example: examples/gcp-observability-curl.toml

This file sets up curl as a proxy tool for Cloud Trace, Cloud Monitoring (v3, MQL, PromQL, dashboards) and Cloud Logging. gcloud covers these REST APIs only partly. The README's proxy-tools section links to it.

• Every path is pinned to my-project, and only read verbs are allowed. The one exception is POST /v2/entries:list, which has no project in its path.
• deny is a carve-out. The monitoring route denies notificationChannels/** and uptimeCheckConfigs/** inside the broad GET /v3/projects/my-project/**. Channel labels and uptime-check headers can carry third-party credentials. Redaction only knows the declared secrets.
• IAM is the stated boundary. The header comment says why: entries:list names its projects in the body, and redaction doesn't cover undeclared credentials.

Verification

• cargo fmt --check, cargo clippy --all-targets -D warnings: clean.
• cargo test --lib: 480 passed. This includes the new method_override_headers_are_refused, which covers every header in any letter case, on GET and POST, with an allow-everything route.
• cargo test --test proxy_e2e_integration: 6 passed.
• A throwaway test loaded every examples/*.toml. All load.
• A throwaway test checked 20 request cases against the example's find_route / permits: allowed reads, refused writes, the deny carve-outs, another project, and an unrouted host. All matched the intended decision.

🤖 Generated with Claude Code