Fix upstream proxy TLS handshake

Program.cs

@@ -164,10 +164,11 @@ class Program
 
         var resp = await ReadHeaders(upstreamStream, $"conn:{connectionId} upstream-connect-response");
 
-        if (resp == null || !resp.Raw.Contains("200"))
+        int statusCode = ParseStatusCode(resp?.Raw);
+        if (resp == null || statusCode != 200)
         {
             var status = resp?.Raw?.Split("\r\n", StringSplitOptions.None).FirstOrDefault() ?? "<no response>";
-            Log.Error($"[conn:{connectionId}] upstream CONNECT rejected: {status}");
+            Log.Error($"[conn:{connectionId}] upstream CONNECT rejected ({statusCode}): {status}");
             await clientStream.WriteAsync(Encoding.ASCII.GetBytes("HTTP/1.1 502 Bad Gateway\r\n\r\n"));
             return;
         }
@@ -318,6 +319,22 @@ class Program
         return message.Replace("\r", " ").Replace("\n", " ").Trim();
     }
 
+    static int ParseStatusCode(string rawHeaders)
+    {
+        if (string.IsNullOrWhiteSpace(rawHeaders))
+            return 0;
+
+        var line = rawHeaders.Split("\r\n", StringSplitOptions.None).FirstOrDefault();
+        if (string.IsNullOrWhiteSpace(line))
+            return 0;
+
+        var parts = line.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        if (parts.Length < 2)
+            return 0;
+
+        return int.TryParse(parts[1], out int code) ? code : 0;
+    }
+
     static int GetHeaderLength(string raw)
     {
         int idx = raw.IndexOf("\r\n\r\n", StringComparison.Ordinal);