Initial vibeproxy implementation

Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go,
with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS
framework), and a REST API under /api/v1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw

internal/access/access_test.go

@@ -0,0 +1,49 @@
+package access
+
+import (
+	"net"
+	"testing"
+
+	"github.com/owen/vibeproxy/internal/models"
+)
+
+func TestAccessListAllowDeny(t *testing.T) {
+	m := models.AccessList{
+		DefaultAllow: false,
+		Rules: []models.AccessRule{
+			{Action: models.AccessAllow, CIDR: "10.0.0.0/8", Priority: 0},
+			{Action: models.AccessDeny, CIDR: "10.1.0.0/16", Priority: 1},
+		},
+	}
+	l := Compile(m)
+
+	cases := []struct {
+		ip   string
+		want bool
+	}{
+		{"10.2.3.4", true},     // matches allow 10.0.0.0/8 first
+		{"192.168.1.1", false}, // no match, default deny
+	}
+	for _, c := range cases {
+		got := l.Allowed(net.ParseIP(c.ip))
+		if got != c.want {
+			t.Errorf("Allowed(%s) = %v, want %v", c.ip, got, c.want)
+		}
+	}
+}
+
+func TestAccessListDefaultAllow(t *testing.T) {
+	m := models.AccessList{DefaultAllow: true}
+	l := Compile(m)
+	if !l.Allowed(net.ParseIP("8.8.8.8")) {
+		t.Fatal("expected default allow to permit unmatched IP")
+	}
+}
+
+func TestAccessListRequiresAuth(t *testing.T) {
+	m := models.AccessList{BasicAuthUsers: []models.AccessListUser{{Username: "bob", PasswordHash: "x"}}}
+	l := Compile(m)
+	if !l.RequiresAuth() {
+		t.Fatal("expected RequiresAuth to be true when users are configured")
+	}
+}