Report downstream connection lifetime through a listener Tracer

[ShanireZ]

Refs #994

Stream already carries an optional Tracer and reports on_disconnected() from its Drop,
but only the upstream connector ever sets it (connectors::l4). Downstream connections have no
equivalent. An application implementing ServerApp can set session.tracer once process_new
hands it the stream, but by then the handshake has already succeeded, so connections that time
out or fail during io.handshake() are never seen — and for an entry point those are the
interesting ones.

This adds an optional Tracer to Listeners, threads it through to each TransportStack, and
attaches a clone of it to every accepted stream, the same way connectors::l4 does for outbound
connections:

let tracer = tracer.clone();
tracer.0.on_connected();
stream.tracer = Some(tracer);

Stream's Drop already reports the disconnect, so the two calls pair by construction: no
ordering question, no double counting, and no way to add one without the other.

Why this covers the handshake window

The tracer rides on the L4 stream, and UninitializedStream::handshake() keeps that stream
alive in both branches — Ok(Box::new(self.l4)) when there is no TLS, and
tls.tls_handshake(self.l4) when there is. A connection that never completes the handshake
therefore still reports its disconnect when the stream is dropped.

Scope

• One file. One new public method (Listeners::set_tracer), shaped after the existing
  set_pre_tls_callback. No signature changes and no new trait.
• No behaviour change when no tracer is set, which remains the default.
• Nothing here knows about metrics: the tracer is the caller's, exactly as it already is for
  upstream connections.
• Attributing connections to a particular listener is deliberately out of scope; feat(listeners): add add_endpoint_with_filter for granular per-address L4 filtering #941 would
  provide that by construction, since a filter instance attached to one address already knows
  its address.

Tests

Two are added, both in listeners::test:

• a connection dropped without ever handshaking reports on_connected and on_disconnected
  exactly once each — the window an application-side counter cannot see;
• the no-tracer default path is unchanged, which fails if accept() ever starts assuming a
  tracer is present.

Verification

Against main @ 09696b5, in a container:

Gate	Result
cargo fmt --all -- --check	passes
cargo clippy --all-targets --all -- --allow=unknown-lints --deny=warnings	passes
cargo test -p pingora-core --lib	557 passed / 2 failed, against 555 / 2 on the unpatched baseline
cargo test --workspace --lib --bins --tests	identical set of failing test names before and after; only the passed count moves, by the two tests added here
git am replay	applies cleanly on 09696b5, and the replayed tree is byte-identical to the development tree

The two pingora-core failures (connectors::l4::tests::test_conn_timeout and
test_bind_to_port_range_on_connect) and the pingora-proxy integration failures are present on
the unpatched baseline as well; the latter need openresty, which the container does not have.
MSRV (cargo +1.85.0 check), cargo audit and cargo machete were not available locally and
are left to CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T08:05:49.534759Z	0dda18b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.