fix(http): advertise Connection: close on every reject-before-read path

Deep-review gate (2026-08-14) findings, all reproduced:

1. close_connection was never serialized: BaseHTTPRequestHandler does not
   emit Connection: close from the flag, so pooled clients kept reusing the
   socket and died with BrokenPipeError. Handler.end_headers() now emits
   the header (deduped) whenever close_connection is armed.
2. check_auth_or_close armed the flag too late (after the 401/302 was
   already flushed); it now arms before check_auth() and restores the
   prior flag on success.
3. The sidecar provenance rejection closed body-less GETs too; the close
   is now gated on read_request_body=True.
4. Remaining reject-before-read sites now close-and-advertise through the
   same mechanism: rate-limited CSP reports (204), the deprecated
   /api/process-complete-ack (410), /api/health/restart (all outcomes),
   and the four upload handlers (413 + pre-read Content-Length/boundary
   validation via _reject_before_read).

Tests: pooled-client regression against the production handler (reject
with a body, then follow-up on the same pooled connection succeeds and the
rejection carries Connection: close); unit coverage for the sidecar GET
keep-alive, CSP rate-limit, health/restart and upload oversize paths. The
server.py line guard is bumped to 760 with rationale: the deep-review
requires the emission in Handler.end_headers(), which cannot live outside
server.py.

server.py

@@ -332,6 +332,12 @@ class Handler(BaseHTTPRequestHandler):
         extra_frame_src = getattr(self, "_csp_extra_frame_src", None)
         self.send_header("Content-Security-Policy-Report-Only", self.csp_report_only_policy(extra_connect_src, extra_frame_src))
         self.send_header("Report-To", self._CSP_REPORT_TO)
+        if self.close_connection and not getattr(self, "_close_advertised", False):
+            # A reject-before-read leaves the body unread; the client must be
+            # TOLD the connection dies or a pooled client reuses it and breaks.
+            # BaseHTTPRequestHandler does not serialize the flag itself.
+            self.send_header("Connection", "close")
+            self._close_advertised = True
         super().end_headers()
 
     def log_message(self, fmt, *args): pass  # suppress default Apache-style log