An upgrade the app accepts under another protocol name is answered 502 (closes #131)

ReverseProxy refuses a 101 whose Upgrade is not the one the client asked
for, but modifyResponse had already counted the 101 as sent, so
answerError sent nothing and the client got an empty 200. The 101 now
counts as sent only once ReverseProxy has taken over the client's
connection, and answerError closes the app's switched connection, which
ReverseProxy leaves open when it refuses the switch.

Model: opus-5-5

internal/proxy/request.go

@@ -395,8 +395,10 @@ func (rq *request) modifyResponse(res *http.Response) error {
 		// timeouts. ReverseProxy writes this answer straight to the
 		// connection it takes over, not through rq.out, and then copies
 		// what passes each way through res.Body, the connection to the app.
+		// It may still refuse the switch, as when the app's Upgrade is not
+		// the client's, so the status is noted only once it has taken over
+		// the connection, by rq.out's Hijack.
 		rq.stopTimers()
-		rq.out.status = res.StatusCode
 		rq.line.Websocket = true
 
 		conn, ok := res.Body.(io.ReadWriteCloser)
@@ -428,6 +430,13 @@ func (rq *request) modifyResponse(res *http.Response) error {
 // answerError is ReverseProxy's ErrorHandler: the request could not be
 // passed to the app, or the app's answer cannot be passed on.
 func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
+	if rq.upgraded != nil {
+		// The app switched protocols, but the switch was not passed on,
+		// and ReverseProxy leaves the app's connection open when it
+		// refuses it.
+		_ = rq.upgraded.Close()
+	}
+
 	refused := rq.refused.Load()
 	if refused == nil {
 		if rq.in.Context().Err() != nil {