- Migrate config.c from pthread_rwlock and __sync builtins to stdatomic.h atomic_fetch_add/sub for ref counting, removing global config_lock
- Replace pthread_mutex_t in health_check.c and monitor.c with lock-free patterns, eliminating vhost_stats_mutex and health_mutex
- Add log file rotation in logging.c with 10MB max size and 5 rotation backups, triggered on fstat size check
- Introduce SSL handshake timeout (SSL_HANDSHAKE_TIMEOUT_SEC) in connection.c with elapsed time tracking via ssl_handshake_start
- Extend upstream connection setup to copy config reference and call config_ref_inc in connection_connect_to_upstream
- Add WAL journal mode and synchronous NORMAL pragmas to monitor.c SQLite init, plus data retention constant and vhost_totals table schema
- Update Makefile with -Werror, -O3, -march=native, -flto flags, separate CFLAGS_DEBUG, add valgrind phony target, and lower min coverage to 60% with new test modules
- Expand .gitignore to cover CLAUDE.md, *.db-wal, and *.db-shm files
- Refactor health_check.c to use snprintf instead of strncpy for hostname/upstream_host with HOSTNAME_MAX_LEN bounds
Implement configurable patch rules for rewriting or blocking textual content in HTTP streams. New `patch` configuration object supports string replacement and content blocking via null values, applied bidirectionally to requests and responses. Blocked responses return 502, blocked requests return 403.
