fix(haproxy): gate http-keep-alive on http mode; clean up keep-alive test

Address Copilot review findings on PR #108:

- Only emit `option http-keep-alive` when backend.Mode == "http"; emitting
  it for tcp-mode backends produces an invalid stanza.
- Drop BackendSSL from the keep-alive test (it was generating `verify`
  with an empty value, unrelated to keep-alive). Add a separate test
  asserting the directive is suppressed for tcp-mode backends.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox-agent/internal/framework/services/haproxy/generator.go

@@ -120,7 +120,7 @@ func (g *Generator) GenerateBackendConfig() string {
 		lines = append(lines, fmt.Sprintf("backend %s", backend.BackendName))
 		lines = append(lines, fmt.Sprintf("  mode %s", backend.Mode))
 		lines = append(lines, fmt.Sprintf("  balance %s", backend.Balance))
-		if backend.HTTPKeepAlive {
+		if backend.HTTPKeepAlive && backend.Mode == "http" {
 			lines = append(lines, "  option http-keep-alive")
 		}
 

gearbox-agent/internal/framework/services/haproxy/generator_test.go

@@ -469,7 +469,6 @@ func TestGenerator_GenerateBackendConfig_HTTPKeepAlive(t *testing.T) {
 			Mode:          "http",
 			Balance:       "roundrobin",
 			HTTPKeepAlive: true,
-			BackendSSL:    true,
 		},
 	}
 
@@ -480,3 +479,23 @@ func TestGenerator_GenerateBackendConfig_HTTPKeepAlive(t *testing.T) {
 		t.Error("GenerateBackendConfig() missing 'option http-keep-alive' directive")
 	}
 }
+
+func TestGenerator_GenerateBackendConfig_HTTPKeepAlive_TCPModeSkipped(t *testing.T) {
+	backends := []compose.BackendConfig{
+		{
+			BackendName:   "keepalive_tcp_backend",
+			Hostname:      "tcp.example.com",
+			Server:        "10.0.0.7:3306",
+			Mode:          "tcp",
+			Balance:       "roundrobin",
+			HTTPKeepAlive: true,
+		},
+	}
+
+	gen := NewGenerator(backends)
+	config := gen.GenerateBackendConfig()
+
+	if strings.Contains(config, "option http-keep-alive") {
+		t.Error("GenerateBackendConfig() emitted 'option http-keep-alive' for tcp-mode backend")
+	}
+}