API v3alpha: harden the ConnectRPC foundation

Parent: #5450

Summary

Harden the ConnectRPC foundation delivered in #5377 before expanding it with write-heavy and long-lived service methods.

The existing foundation already supports Connect, gRPC-Web, native gRPC, health, reflection, route prefixes, independent unary/stream admission, and bounded instrumentation paths. This issue covers the remaining production-readiness and extensibility gaps.

Scope

Admission observability

Add bounded metrics for:

• Unary RPCs in flight.
• Unary admission rejections.
• Unary durations and deadline expirations.
• Active and rejected streams.
• Stream lifetimes.
• Queue-overflow closures once watch queues exist.

Pass a Prometheus registerer and explicit policy values through the API options. Connect metrics must use fixed service/procedure and outcome labels rather than request-controlled paths.

Request and stream controls

• Configure explicit incoming and outgoing protobuf message limits; Connect defaults both directions to unlimited.
• Add request-body/read controls that apply before unary protobuf decoding. The current unary interceptor deadline begins after Connect receives the request message.
• Define distinct per-message, idle, lifetime, cancellation, and queue policies for streams.
• Do not wrap streams with http.TimeoutHandler or apply a global unary-style timeout to long-lived streams.
• Preserve independent capacity for API v2 GETs, Connect unary RPCs, and Connect streams.

Service registration

Replace the separately maintained handler registrations, health/reflection service names, and instrumentation prefixes with one explicit canonical service descriptor. Keep the instrumentation allowlist fixed, bounded, and pinned by tests.

TLS verification

Extend the in-process e2e harness to exercise exporter-toolkit TLS configuration and verify:

• Connect over HTTPS.
• Connect HTTP GET over HTTPS.
• gRPC-Web over HTTPS.
• Native gRPC with TLS and HTTP/2 ALPN.
• Health and reflection.
• Root and non-root route prefixes.

Retain the existing plaintext h2c matrix and document the operational exposure model for h2c.

Acceptance criteria

• Admission and stream lifecycle metrics are registered with bounded labels.
• Oversized incoming messages fail predictably with ResourceExhausted.
• Slow unary uploads are bounded before handler execution.
• Stream cancellation, idle, and lifetime controls release all capacity.
• API v2 behavior and capacity remain independent and unchanged.
• One explicit service descriptor drives handlers, health, reflection, and instrumentation prefixes.
• Connect, gRPC-Web, native gRPC, health, and reflection pass over configured TLS and h2c.
• Ginkgo/Gomega tests cover limits, saturation, cleanup, and transport behavior.