Client-side MASQUE CONNECT-TCP session over HTTP/1.1.

Classic HTTP CONNECT (RFC 9110 §9.3.6 / RFC 9112 §3.2.3). This is the method every HTTPS proxy has spoken for decades: the client writes CONNECT host:port HTTP/1.1 with a Host header, the server replies 200 Connection Established, and the raw TLS socket then carries arbitrary TCP bytes both ways. Not Extended CONNECT, no :protocol, no capsules.

Intentionally bypasses h1_connection: after the 200, the connection is no longer HTTP, so driving it through the h1 state machine gains nothing and actively conflicts with the tunnel handoff (h1:accept_connect/3 is the server-side analogue the listener uses).

Cleartext is out of scope: we only open ssl:connect/4 with ALPN http/1.1. This matches the TLS-only contract documented in the h1 fallback plan.