feat: Support HTTP/2 WebSocket (Extended CONNECT / RFC 8441) for Tailscale Funnel

[downwind7clawd-ctrl]

Problem

When accessing Nerve via Tailscale Funnel, the WebSocket connection fails with a generic error. The root cause is that Tailscale Funnel only supports HTTP/2, and browsers automatically negotiate HTTP/2 when connecting.

WebSocket over HTTP/2 requires RFC 8441 Extended CONNECT, which is not supported by the current WebSocket proxy implementation.

Steps to Reproduce

1. Set up Tailscale Funnel to expose Nerve (port 3080)
2. Access Nerve via the Funnel HTTPS URL in a browser
3. Enter Gateway Token in the Handshake dialog
4. Click 'Connect' → WebSocket error occurs

Root Cause

• Tailscale Funnel uses HTTP/2 exclusively
• HTTP/1.1 WebSocket upgrade mechanism doesn't work over HTTP/2
• HTTP/2 requires Extended CONNECT (RFC 8441) for WebSocket
• Current Nerve ws-proxy doesn't implement Extended CONNECT

Expected Behavior

Nerve should support WebSocket connections over HTTP/2 via Extended CONNECT, enabling Tailscale Funnel and other HTTP/2-only reverse proxies.

Workaround

Use Tailscale direct connection (not Funnel) or RustDesk for remote access.

Environment

• Nerve version: 1.5.1
• OpenClaw Gateway: password auth mode
• Tailscale Funnel: HTTPS endpoint
• Browser: Firefox/Chrome (both negotiate HTTP/2)