feat(gateway): add per-app connection rate limiting

[kvinwang]

Summary

Add configurable maximum concurrent connections per app to prevent a single slow or overloaded app from exhausting system resources (especially upstream port pool) and affecting other apps.

• Add max_connections_per_app config option in [core.proxy] section
• Default value: 2000 connections per app
• Set to 0 for unlimited (not recommended in production)
• Check connection count before establishing new backend connections
• Log warning when rate limit is exceeded

Background

When an app becomes slow or overloaded, connections to it accumulate and don't release promptly. This can exhaust the upstream load balancer's port pool (since all connections come from the same source IP), causing connection failures for ALL apps - not just the problematic one.

This rate limiting ensures that a single misbehaving app cannot monopolize resources and impact the entire gateway.

Configuration

[core.proxy]
# Maximum concurrent connections per app. 0 means unlimited.
max_connections_per_app = 2000

Test Results

Tested on TDX host with gateway CVM (10.20.0.124:14100, max_connections_per_app = 50) and echo CVM (ports 5001-5005).

Test 1: 30 connections (within limit)

• Result: 30/30 all succeeded, 0 errors

Test 2: 100 connections (exceeding limit)

• TCP+TLS: 100/100 succeeded (rate limit applies at backend connection stage, not TLS handshake)
• Active (got upstream response): 50 — exactly at the limit
• Upstream errors: 50 — excess connections rejected
• Gateway logs WARN correctly: app connection limit exceeded app_id="..." total=50 max_connections=50

=== Final Stats ===
TCP connected:   100
TLS completed:   100
Active (got response): 50
Closed:          50
Err upstream:    50

Conclusion

Rate limiting works as expected, precisely capping concurrent backend connections per app. Excess connections are rejected after TLS handshake but before backend connection establishment.