feat(tcp): add praxis_tcp_connection_duration_seconds histogram metric

[tsisodia10]

Record TCP connection lifetime (accept to close) as a Prometheus histogram labeled by listener name. The metric is emitted on all disconnect paths and exposed via the admin /metrics endpoint when enabled.

What does this PR do?

Adds a praxis_tcp_connection_duration_seconds Prometheus histogram that records the lifetime of each TCP connection (from accept to close), labeled by listener name. This gives operators visibility into how long TCP connections live across different listeners.

Changes:

• New protocol/src/tcp/metrics.rs module with record_tcp_connection_duration()
• Records duration at all disconnect exit paths in PingoraTcpProxy::process_new()
• Uses the existing listener_label_for() infrastructure for accurate per-listener labeling
• Example config: examples/configs/observability/tcp-connection-metrics.yaml
• Unit tests (no-panic without recorder) and integration tests (metric emission + correct labels)

Which issue(s) does this relate to?

Fixes #1027

Checklist

• Signed off all commits (git commit -s)
• Tests added or updated
• Documentation updated (if applicable)
• make lint && make test passes locally

Does this introduce a breaking change?

No. The metric is purely additive and only emitted when the admin interface is enabled.

[praxis-bot-app]

Tool authorship detected:

• bf2a5ab: Co-authored-by: Cursor <cursoragent@cursor.com>

This project doesn't allow commits which are authored or signed-off by tools.
Commits need to be authored by and signed-off by the human(s) responsible for the PR, with their name and contact.
Please see our development documentation for more details.

[praxis-bot]

TCP Connection Duration Metric Review

One finding identified in the metric recording coverage.

[aslakknutsen]

sni_timeout and filter_rejection have measurable connection times and will be in connection_close logs, but not recorded as part of histogram.

Intentional?

Would it perhaps make sense to add a label for the connection close type?

[tsisodia10]

sni_timeout and filter_rejection have measurable connection times and will be in connection_close logs, but not recorded as part of histogram.

Intentional?

Would it perhaps make sense to add a label for the connection close type?

Good catch - not intentional, these paths should be recorded too.

On the reason label: makes sense. I'll add a reason label with values like completed, sni_timeout, filter_rejection, connect_failure, and peeked_write_error so operators can slice the histogram by close type.

[aslakknutsen]

Worth a mention in

praxis/docs/operating/observability.md

Line 134 in bf5d7a8

### HTTP Request Metrics

?

[tsisodia10]

Worth a mention in

praxis/docs/operating/observability.md

Line 134 in bf5d7a8

### HTTP Request Metrics

?

Added under ### TCP Connection Metrics section. Also updated the intro to reflect three metric categories.

[praxis-bot]

TCP Connection Duration Metric Re-review

One new finding since the previous review. The earlier connect_failure exit path coverage issue appears resolved in the current code.

[praxis-bot-app]

Commit message format: the following commits do not follow conventional commits:

• 88d9488: style(protocol): rustfmt TCP connection duration metric

Expected format: type(scope): summary (max 72 chars). Types: build, chore, ci, docs, feat, fix, perf, refactor, test.

[praxis-bot-app]

Unsigned commits: f2b988f. Please sign your commits.