fix: is_closed reads curl_cffi's private _closed (no public closed attr)

CurlCffi.is_closed read getattr(session, 'closed', False), but curl_cffi tracks closed state only in the private _closed and exposes no public 'closed' property, so it always returned False. it now reads _closed, falling back to a public 'closed' if a future version adds one. TLSSession's own flag remains the primary signal; this is the best-effort backend check for out-of-band closes.

Signed-off-by: disqualifier <dev@disqualifier.me>

src/aioweb_tls/backends.py

@@ -105,8 +105,17 @@ class CurlCffi:
         )
 
     def is_closed(self, session) -> bool:
-        """whether the curl_cffi session is closed"""
-        return bool(getattr(session, "closed", False))
+        """whether the curl_cffi session is closed
+
+        curl_cffi tracks closed state in the private `_closed` (no public `closed`
+        property), so read that; fall back to a public `closed` if a future version
+        adds one. TLSSession's own `_closed` flag is the primary signal — this is a
+        best-effort backend check for out-of-band closes.
+        """
+        closed = getattr(session, "_closed", None)
+        if closed is None:
+            closed = getattr(session, "closed", False)
+        return bool(closed)
 
     def cookies_for_url(self, session, url) -> dict:
         """cookies curl_cffi would send for url (best-effort)"""