[kernaxis]

What & why

Public health checks create a new HTTP transport for every probe. When a response is fully consumed, its connection can remain idle indefinitely in a transport that is never reused.

Add defer client.CloseIdleConnections() after client creation. Deferred cleanup runs after the response body is closed, releasing idle connections while preserving existing probe behavior.

Add a regression test covering repeated HTTPS probes returning HTTP 200, 302 and 204. It verifies connection closure and persisted health results.

Related issue

none

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / internal (no behavior change)
• Build / CI / tooling

Checklist

• go build ./... compiles and go test ./... passes
• Commits are clean (WIP squashed) and the PR is focused on one concern
• Code matches the existing style (no new linters required)
• User-facing change is noted in CHANGELOG.md with a version bump
• Docs updated where relevant (README, in-app web/templates/docs.html, and/or the wiki)
• I agree my contribution is licensed under the project's Apache License 2.0

Notes for reviewers

The regression test fails without the fix and passes with it. Existing public health tests also pass:

go test -mod=readonly ./internal/server \
  -run '^(TestCheckProxyHostClosesIdleConnections|TestCheckAllProxyHosts.*|TestPublicHealth.*)$' \
  -count=1

This PR contains only the connection cleanup and its regression test, no changelog or version bump is included.