refactor: decompose large functions and remove dead code

- Decompose modify_request() into 7 single-responsibility helpers
- Decompose handle_http_over_tls(): extract read_full_request, dispatch_stream_events
- Promote connect_upstream/resolve_upstream to module-level functions
- Split standalone.rs (1238 lines) into 4 submodules:
  standalone/mod.rs, spawn.rs, discovery.rs, stub.rs
- Extract proto wire primitives into proto/wire.rs
- Remove 6 dead MitmStore methods
- Remove dead SessionResult, DEFAULT_SESSION, get_or_create
- Remove dead decode_varint_at, extract_conversation_id
- Clean all unused imports across 10 files
- Suppress structural dead_code warnings on deserialization fields

Warnings: 20 -> 0. All 43 tests pass.

src/mitm/intercept.rs

@@ -129,14 +129,21 @@ impl StreamingAccumulator {
                             else if let Some(fc) = part.get("functionCall") {
                                 let name = fc["name"].as_str().unwrap_or("unknown").to_string();
                                 let args = fc["args"].clone();
+                                // thoughtSignature is a SIBLING of functionCall in the part,
+                                // not nested inside functionCall
+                                let thought_signature = part.get("thoughtSignature")
+                                    .and_then(|v| v.as_str())
+                                    .map(|s| s.to_string());
                                 info!(
                                     tool_name = %name,
                                     tool_args = %args,
+                                    has_thought_sig = thought_signature.is_some(),
                                     "MITM: Google returned functionCall!"
                                 );
                                 self.function_calls.push(CapturedFunctionCall {
                                     name,
                                     args,
+                                    thought_signature,
                                     captured_at: std::time::SystemTime::now()
                                         .duration_since(std::time::UNIX_EPOCH)
                                         .unwrap_or_default()
@@ -300,42 +307,51 @@ fn extract_usage_from_message(msg: &Value) -> Option<ApiUsage> {
 
 /// Try to identify a cascade ID from the request body.
 ///
-/// The LS includes cascade-related metadata in its API requests (as part of
-/// the system prompt or metadata field). We try to find it.
+/// Priority:
+/// 1. `<cid:UUID>` marker embedded by our proxy in the user message content
+/// 2. `requestId` field: `agent/{timestamp}/{cascade_uuid}/{sequence}` format
+/// 3. `metadata.user_id` fallback
 pub fn extract_cascade_hint(request_body: &[u8]) -> Option<String> {
-    let json: Value = serde_json::from_slice(request_body).ok()?;
-
-    // Check for metadata field (some API configurations include it)
-    if let Some(metadata) = json.get("metadata") {
-        if let Some(user_id) = metadata["user_id"].as_str() {
-            // The LS often sets user_id to the cascadeId
-            return Some(user_id.to_string());
+    // Fast path: look for <cid:UUID> marker in raw bytes (avoid JSON parse)
+    let body_str = std::str::from_utf8(request_body).ok()?;
+    if let Some(start) = body_str.find("<cid:") {
+        let rest = &body_str[start + 5..];
+        if let Some(end) = rest.find('>') {
+            let candidate = &rest[..end];
+            // Validate UUID format
+            if candidate.len() == 36
+                && candidate.chars().filter(|c| *c == '-').count() == 4
+                && candidate.chars().all(|c| c.is_ascii_hexdigit() || c == '-')
+            {
+                return Some(candidate.to_string());
+            }
         }
     }
 
-    // Check system prompt for cascade/workspace markers
-    if let Some(system) = json.get("system") {
-        let system_str = match system {
-            Value::String(s) => s.clone(),
-            Value::Array(arr) => {
-                // Array of content blocks
-                arr.iter()
-                    .filter_map(|b| b["text"].as_str())
-                    .collect::<Vec<_>>()
-                    .join(" ")
-            }
-            _ => return None,
-        };
-        // Look for workspace_id or cascade_id patterns
-        if let Some(pos) = system_str.find("workspace_id") {
-            let rest = &system_str[pos..];
-            // Extract the value after workspace_id
-            if let Some(val) = rest.split_whitespace().nth(1) {
-                return Some(val.to_string());
+    let json: Value = serde_json::from_slice(request_body).ok()?;
+
+    // Secondary: extract cascade UUID from requestId field
+    // Format: "agent/{timestamp}/{cascade_uuid}/{sequence}"
+    if let Some(request_id) = json.get("requestId").and_then(|v| v.as_str()) {
+        let parts: Vec<&str> = request_id.split('/').collect();
+        if parts.len() >= 3 {
+            let candidate = parts[2];
+            if candidate.len() == 36
+                && candidate.chars().filter(|c| *c == '-').count() == 4
+                && candidate.chars().all(|c| c.is_ascii_hexdigit() || c == '-')
+            {
+                return Some(candidate.to_string());
             }
         }
     }
 
+    // Fallback: check metadata.user_id
+    if let Some(metadata) = json.get("metadata") {
+        if let Some(user_id) = metadata["user_id"].as_str() {
+            return Some(user_id.to_string());
+        }
+    }
+
     None
 }