Function build_app 

pub fn build_app(config: Config) -> Router

Build the application: the reverse proxy wrapped by the gate.

The proxy is mounted at / so every path is forwarded. Rfc9110Layer strips hop-by-hop headers (the base proxy does not) while preserving the WebSocket upgrade handshake. The gate is the outermost layer, so it decides passthrough-vs-wall before the proxy ever sees a request.