feat(smart-proxy): add hot-reloadable global ingress security policy across Rust and TypeScript proxy layers

rust/crates/rustproxy-passthrough/src/connection_tracker.rs

@@ -31,7 +31,8 @@ impl ConnectionTracker {
     pub fn try_accept(&self, ip: &IpAddr) -> bool {
         // Check per-IP connection limit
         if let Some(max) = self.max_per_ip {
-            let count = self.active
+            let count = self
+                .active
                 .get(ip)
                 .map(|c| c.value().load(Ordering::Relaxed))
                 .unwrap_or(0);
@@ -48,7 +49,10 @@ impl ConnectionTracker {
             let timestamps = entry.value_mut();
 
             // Remove timestamps older than 1 minute
-            while timestamps.front().is_some_and(|t| now.duration_since(*t) >= one_minute) {
+            while timestamps
+                .front()
+                .is_some_and(|t| now.duration_since(*t) >= one_minute)
+            {
                 timestamps.pop_front();
             }
 
@@ -111,7 +115,6 @@ impl ConnectionTracker {
     pub fn tracked_ips(&self) -> usize {
         self.active.len()
     }
-
 }
 
 #[cfg(test)]