🐛 restore the drain that a stray checkout reverted

Commit 7eedf65 accidentally reverted bouncer.go: a scratch copy of this
worktree kept a .git file pointing back here, so a `git checkout origin/main --
bouncer.go` run inside the copy wrote the revert into this index, and the next
commit carried it. The branch was left with the regression test but not the fix,
which is exactly what CI reported -- 10 connections for 10 calls.

Restores the drain, the dead-branch removal and MaxIdleConnsPerHost. Re-verified
against all three CI gates in containers: golangci-lint v1.63.4 clean,
go test -cover green, yaegi v0.16.1 PASS.

bouncer.go

@@ -243,17 +243,19 @@ func New(_ context.Context, next http.Handler, config *configuration.Config, nam
 		},
 		httpClient: &http.Client{
 			Transport: &http.Transport{
-				MaxIdleConns:    10,
+				MaxIdleConns:        10,
-				IdleConnTimeout: 30 * time.Second,
+				MaxIdleConnsPerHost: 10,
-				TLSClientConfig: tlsConfig,
+				IdleConnTimeout:     30 * time.Second,
+				TLSClientConfig:     tlsConfig,
 			},
 			Timeout: time.Duration(config.HTTPTimeoutSeconds) * time.Second,
 		},
 		httpAppsecClient: &http.Client{
 			Transport: &http.Transport{
-				MaxIdleConns:    10,
+				MaxIdleConns:        10,
-				IdleConnTimeout: 30 * time.Second,
+				MaxIdleConnsPerHost: 10,
-				TLSClientConfig: tlsAppsecConfig,
+				IdleConnTimeout:     30 * time.Second,
+				TLSClientConfig:     tlsAppsecConfig,
 			},
 			Timeout: time.Duration(config.HTTPTimeoutSeconds) * time.Second,
 		},
@@ -278,7 +280,7 @@ func New(_ context.Context, next http.Handler, config *configuration.Config, nam
 		log,
 		bouncer.cacheClient,
 		&http.Client{
-			Transport: &http.Transport{MaxIdleConns: 10, IdleConnTimeout: 30 * time.Second},
+			Transport: &http.Transport{MaxIdleConns: 10, MaxIdleConnsPerHost: 10, IdleConnTimeout: 30 * time.Second},
 			Timeout:   time.Duration(config.HTTPTimeoutSeconds) * time.Second,
 		},
 		config.CaptchaProvider,
@@ -801,6 +803,13 @@ func appsecQuery(bouncer *Bouncer, ip string, httpReq *http.Request) error {
 		return nil
 	}
 	defer func() {
+		// net/http only returns a connection to the idle pool once its body has
+		// been read to EOF; closing early discards it. Drain here rather than at
+		// the end of the function so the 500 and non-200 paths, which return
+		// earlier, keep their connections too.
+		if _, errDrain := io.Copy(io.Discard, res.Body); errDrain != nil {
+			bouncer.log.Debug("appsecQuery:drainBody " + errDrain.Error())
+		}
 		if err = res.Body.Close(); err != nil {
 			bouncer.log.Error("appsecQuery:closeBody " + err.Error())
 		}
@@ -816,9 +825,6 @@ func appsecQuery(bouncer *Bouncer, ip string, httpReq *http.Request) error {
 		return fmt.Errorf("appsecQuery statusCode:%d", res.StatusCode)
 	}
 
-	if err != nil {
-		return fmt.Errorf("appsecQuery:readBody %w", err)
-	}
 	return nil
 }