Attempted docs-literal config (gateways.secure.port: 443) as unprivileged user:
Error: failed to start bind listener(s): bind bind/443: bind listener for [::]:443: Permission denied (os error 13)

Adaptation: use binds[].mode: internal for port 443 (documented on the same egress-proxy page
under "Inspect all HTTPS traffic" as routing-only / no OS listener). Semantics remain
tunnelProtocol: connect + TLS SNI tcpRoutes hostnames allowlist + dynamic backend.