The manager checked LastSeen on the peer it already held and then issued an
unconditional UPDATE, so concurrent requests for one peer could each pass the
check off the same stale read and write. The cutoff now travels to the store
and lands in the statement's WHERE, matching how MarkPeerConnectedIfNewerSession
fences its own write, and the local check stays as the query-free fast path.
Recording proxy usage is business logic, and it had ended up in the RPC
handler: the throttle interval, the service-user skip, the exclusion rule
for embedded and browser peers, and a store handle to write through.
It moves to a reverseproxy module manager, matching how accesslogs, domain,
service and proxy are already structured, and the RPC keeps only what is
its own: calling the manager and deciding the request must not fail when
the write does. The proxy service goes back to holding ProxyTokenChecker
rather than a widened store interface.
The policy tests move with the policy. The handler tests now assert only
that a granted request reaches the manager, which is all the transport
decides.
