feat: listener retry override, pool protocol filter, conn pool docs

- Per-listener `retries` overrides global default (0 = inherit)
- Pool-level `allowed_protos` filters proxies during merge
- Connection pooling documented in CHEATSHEET.md
- Both features exposed in /config and /status API responses
- 12 new tests (config parsing, API exposure, merge filtering)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

TODO.md

@@ -6,14 +6,14 @@
 - Chain randomization modes (round-robin, sticky-per-destination)
 - Systemd socket activation
 - Per-pool health test chain override (different base chain per pool)
-- Pool-level proxy protocol filter (only socks5 from pool X, only http from pool Y)
-- Listener-level retry override (different retry count per listener)
+- ~~Pool-level proxy protocol filter (only socks5 from pool X, only http from pool Y)~~ (done)
+- ~~Listener-level retry override (different retry count per listener)~~ (done)
 
 ## Performance
 
 - Benchmark relay throughput vs direct connection
 - Tune buffer sizes for different workloads
-- Connection pooling for frequently-used chains
+- ~~Connection pooling for frequently-used chains~~ (done: `pool_size`/`pool_max_idle`)
 
 ## Security
 
@@ -23,7 +23,7 @@
 
 ## Observability
 
-- Prometheus metrics endpoint (`/metrics` in OpenMetrics format)
+- ~~Prometheus metrics endpoint (`/metrics` in OpenMetrics format)~~ (done)
 - Per-pool health test success rate tracking
 - Per-pool latency breakdown in `/status`