feat(go): add 100k ingest hardening baseline

go/vehicle-gateway/internal/gateway/tcp_server.go

@@ -143,6 +143,7 @@ func (s *TCPServer) ListenAndServe(ctx context.Context) error {
 				s.handleConnection(ctx, conn)
 			}()
 		default:
+			s.recordConnectionRejection("max_connections")
 			s.logger.Warn("tcp connection rejected: max connections reached", "protocol", s.protocol.Protocol, "remote", conn.RemoteAddr().String())
 			_ = conn.Close()
 		}
@@ -367,6 +368,16 @@ func (s *TCPServer) recordConnectionMetric(delta float64) {
 	}, delta)
 }
 
+func (s *TCPServer) recordConnectionRejection(reason string) {
+	if s.metrics == nil {
+		return
+	}
+	s.metrics.IncCounter("vehicle_gateway_connection_rejections_total", metrics.Labels{
+		"protocol": string(s.protocol.Protocol),
+		"reason":   reason,
+	})
+}
+
 func identityStatus(env envelope.FrameEnvelope) string {
 	if strings.TrimSpace(env.VIN) != "" {
 		return "resolved"