A forward HTTP proxy that intercepts HTTPS traffic via TLS MITM for future ad filtering. Fully stdlib-based, no third-party dependencies. Features: - Plain HTTP request forwarding with hop-by-hop header stripping - HTTPS interception via CONNECT + dynamic per-host TLS certificates - Auto-generated CA certificate persisted to ~/.ublproxy/ on first run - Portal page at the proxy address with CA download and install instructions - CLI flags for addr, port, and CA directory Testing: - 8 self-contained e2e tests (HTTP/HTTPS GET, POST, headers, portal) - Tests use in-memory CA and httptest servers, no network access needed Tooling: - Mise config pinning Go 1.25 with file-based tasks in scripts/ - scripts/build, scripts/test, scripts/dev for common workflows - CONTRIBUTING.md documenting setup, usage, and project structure