Use type system to prevent request validation bypasses

## Summary
We should refactor the proxy request handling to use the type system to ensure all requests passed to upstream servers have been validated by the RuleEngine, making it impossible at compile time to accidentally bypass security checks.

## Background
While fixing the Host header bypass vulnerability (#57), we added runtime validation to ensure the Host header matches the URI. However, this and similar security checks could be better enforced through the type system.

## Proposed Solution
Introduce type-safe request handling that guarantees validation:

```rust
// Example approach
struct ValidatedRequest {
// Can only be constructed after passing RuleEngine validation
inner: Request>,
}

impl ValidatedRequest {
// Private constructor - only RuleEngine can create these
fn new(request: Request, validation_result: RuleEvaluation) -> Result {
// Ensure all headers match validated URL
// Apply any security transformations
}
}

// Upstream client only accepts ValidatedRequest
fn send_to_upstream(request: ValidatedRequest) -> Result {
// Impossible to send unvalidated requests
}
```

## Benefits
1. **Compile-time safety** - Makes it impossible to accidentally forward unvalidated or modified requests
2. **Clear security boundaries** - Type system enforces that all upstream requests go through validation
3. **Prevents regression** - New code can't accidentally bypass security checks
4. **Self-documenting** - Types make security requirements explicit

Start by locating the proxy request-handling entry point and the RuleEngine, then trace how requests are validated, transformed, and sent upstream. The issue names no files or tests; done means upstream forwarding accepts only a type that can be created after validation, with the Host-header and related bypass checks covered.

Written by the indexing model from the issue text.