Function handle_passthrough 

pub async fn handle_passthrough(
    stream: &mut TcpStream,
    tls: &ListenerTls,
    gateway: &Gateway,
    pick: Option<EndpointPicker<'_>>,
) -> Result<PassthroughAction>

Peek the ClientHello off a passthrough connection, decide the route, and either splice both directions to the upstream or close.

pick is the endpoint resolver handed to resolve_passthrough (upstream name -> load-balanced (address, port); None falls back to the first configured endpoint). Peeking (never reading) keeps the bytes available for the upstream once splicing starts: the entire hello — including fragments that had to be reassembled for the SNI decision (#120) — is still in the socket buffer and is replayed to the upstream by the splice. A ClientHello fragmented across records is waited for (bounded) rather than closed as no-SNI.