Function should_send_pp

gateway/src/proxy/port_policy.rs:129–136

Decide whether the gateway should send a PROXY protocol header on the outbound connection to (`instance_id`, `port`). Cache hit returns the declared value. Cache miss returns `false` (no PP) — `is_port_allowed` runs first under fail-close and would have rejected the connection if the policy were truly unknown, so by the time we get here the cache is normally populated. The default-false fallback

(state: &Proxy, instance_id: &str, port: u16)

/// cache is normally populated. The default-false fallback is conservative
/// because a missing PP header is safer than a forged one.
pub(crate) fn should_send_pp(state: &Proxy, instance_id: &str, port: u16) -> bool {
    state
        .lock()
        .instance_port_policy(instance_id)
        .and_then(|p| p.ports.get(&port))
        .map(|f| f.pp)
        .unwrap_or(false)
}

/// Spawn the background lazy-fetch worker. Should be called once at startup.
pub(crate) fn spawn_fetcher(state: Proxy, mut rx: UnboundedReceiver<String>) {