- Create package-level httpClient with 300s timeout\n- Reuse client instead of creating new one per request\n- Prevents resource exhaustion under load\n- Reduces connection overhead
- Define blockedHeaders map for headers that should never be forwarded
- Include Referer, Cookie, X-Forwarded-* headers
- Prevents leaking internal URLs, session data, and client IPs to upstream
- Defensive measure even though no headers are currently copied