[v0.48] Enforce global stream limit per WebSocket subscription

[peterargue]

Backport of #8536 to v0.48.

Summary

• Moves the global stream limiter from the WebSocket connection level to the subscription level
• The /ws endpoint multiplexes many subscriptions over a single connection, so the previous connection-level enforcement was incorrect: one connection could bypass MaxGlobalStreams, while idle connections consumed the budget
• Adds Acquire()/Release() methods to ConcurrencyLimiter for lifecycle-scoped slot management
• The limiter is now passed into the WebSocket controller and acquired/released per subscription in handleSubscribe

Test plan

• ConcurrencyLimiter tests for Acquire/Release (within limit, at limit, concurrent)
• Controller test: subscription rejected with 429 when global limit exhausted
• Controller test: slot released when provider creation fails
• Controller test: slot released when provider completes
• Full websocket test suite passes

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 51ad3a00-9b80-4c53-af7e-2445e47fcad5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch peter/v0.48-improve-max-stream-enforcement-ws

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 82.75862% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
engine/access/rest/router/router.go	0.00%	2 Missing ⚠️
engine/access/rest/websockets/handler.go	0.00%	2 Missing ⚠️
engine/access/rest/websockets/controller.go	94.11%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!