Suppress TLS tracing in connection pool after first TLS handshake

The previous fix only suppressed TLS tracing in one.ml (one-shot
requests), but session-based requests go through conpool which makes
TLS connections separately. Add the same suppression mechanism to
conpool to ensure TLS debug hexdumps are suppressed for pooled
connections as well.

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

ocaml-conpool/lib/conpool.ml

···
 module Stats = Stats
 module Cmd = Cmd
 
+(* Track whether TLS tracing has been suppressed *)
+let tls_tracing_suppressed = ref false
+
+(* Suppress TLS tracing debug output (hexdumps) unless explicitly enabled *)
+let suppress_tls_tracing () =
+  if not !tls_tracing_suppressed then begin
+    tls_tracing_suppressed := true;
+    match List.find_opt (fun s -> Logs.Src.name s = "tls.tracing") (Logs.Src.list ()) with
+    | Some tls_src ->
+        (* Only suppress if currently at Debug level *)
+        (match Logs.Src.level tls_src with
+         | Some Logs.Debug -> Logs.Src.set_level tls_src (Some Logs.Warning)
+         | _ -> ())
+    | None -> ()
+  end
+
 (** {1 Error Types} *)
 
 type error =
···
               Domain_name.(host_exn (of_string_exn (Endpoint.host endpoint)))
             in
             let tls = Tls_eio.client_of_flow ~host tls_config socket in
+            (* Suppress TLS tracing after first connection creates the source *)
+            suppress_tls_tracing ();
             Log.info (fun m ->
                 m "TLS connection established to %a" Endpoint.pp endpoint);
             ((tls :> connection), Some tls)