fix(pullsync): limit concurrent incoming streams per peer

[acud]

Description

Limits how many incoming pullsync streams a single peer can have open at the same time.

• Each peer gets a token pool (a buffered channel) that is created on its first stream. A handler takes a slot without blocking when a stream arrives and gives it back when the stream finishes.
• Limits are 128 concurrent pullsync streams and 4 concurrent cursors streams per peer. An honest puller opens at most 2 × MaxBins = 64 sync streams per peer (one historical and one live per bin), so 128 leaves room for streams the remote has closed but whose handler hasn't returned yet.
• When a peer goes over the limit, the stream is reset, the peer address is logged at warning level, the pullsync_stream_limit_exceeded counter is incremented, and the handler returns a p2p.DisconnectError, which makes the p2p layer disconnect the peer.
• The peer's pools are deleted in the protocol's disconnect hook.

Tests

• Unit tests for the limiter: a full pool refuses, releasing frees a slot, peers don't share pools, and releasing after a clear doesn't block.
• Handler tests for both streams: once the limit is reached, the handler returns a disconnect error, resets the stream and increments the metric.

🤖 Generated with Claude Code