mcp-proxy does not try the next DNS A record on connection-refused - 502 origin_bad_gateway while N-1 origin addresses are healthy

### MCP server URL or name

https://mcp.example.com (self-hosted, GeoDNS, 3 A records)

### How are you connecting to this server?

From a custom connector URL I entered manually

### Where does the issue occur?

During a conversation (after initial auth)

### When did you last reproduce this?

2026-07-22 09:55 UTC

### Browser and OS

_No response_

### Describe the issue

Our MCP server sits behind a GeoDNS hostname with 3 A records. One
backend was taken out of rotation for planned maintenance the standard
way: iptables REJECT on 80/443, i.e. instant TCP RST. The other two
addresses kept serving normally.

During that window, tool calls through the connector failed
intermittently with:

Error 502: Bad gateway - zone "mcp-proxy.anthropic.com",
error_name "origin_bad_gateway", owner_action_required: true
ray_id a1f17420cdbf2dc2 (09:35:09Z), a1f18308b89682c4 (09:45:20Z),
a1f189d6199b82c4 (09:49:59Z)

Some calls in the same minutes succeeded - consistent with the proxy
picking one resolved address per request and never retrying another on
ECONNREFUSED.

Control, same time, independent vantage: curl against the same
hostname returned the expected 401 instantly (transparent failover
past the refused address, standard RFC 1123 section 2.3 client
behavior); per-address probes: 401 on both live addresses, immediate
connection-refused on the maintenance one.

### Error details

```shell
None
```

### Expected behavior

on ECONNREFUSED (at minimum - ideally also on connect
timeout), try the remaining resolved addresses before declaring the
origin down. "owner_action_required" is wrong while N-1 addresses
serve; every browser rides through this maintenance pattern invisibly.

### Additional context

_No response_