feat(monitoring): preserve connection visibility over gRPC - #497

PR Summary

High Risk
Breaking gRPC/proto change (TcpStats → ConnectionStats) and new auth checks on monitoring RPCs; connection tracking sits on the Kestrel pipeline for every accepted connection.

Overview
Replaces legacy TCP-specific monitoring with shared HTTP/gRPC connection visibility on the node endpoint, and surfaces that in the Observability UI alongside replication sessions.

gRPC contract: TcpStats is renamed to ConnectionStats with richer fields (is_tls, protocol, application, connected_at, int64 pending byte counts). The monitoring service now reads live connections from IConnectionStatsProvider instead of GetFreshTcpConnectionStats on the monitoring queue. Stats, ConnectionStats, and ReplicationStats all enforce statistics/replication authorization before returning data.

Runtime tracking: A new NodeConnectionTracker wraps Kestrel connections (byte counting on pipes, request metadata from middleware) and is registered in Program.cs on all listen paths. QueueDashboardService drops TCP polling and parallel-fetches queue stats, replication stats, and in-process connection snapshots; partial failures still expose network/replication when queue stats fail (and vice versa), with networkAvailable gating exposure when statistics access is denied.

UI & CI: Observability replaces the TCP dashboard with network boundary and gRPC replication tables; queue-dashboard.js drives live updates from nodeConnections / replicationConnections. Node tests cover replication error handling; C# adds Kestrel/integration and regression tests. metricsconfig.json drops the Tcp queue label group.

^{Reviewed by Cursor Bugbot for commit 7133fb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Walkthrough

The change replaces TCP observability with shared network and replication connection statistics. It adds a gRPC connection-stats contract, integrates NodeConnectionTracker, updates dashboard data and rendering, removes TCP monitoring messages, and adds regression coverage.

Changes

Connection observability

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant MonitoringClient
  participant Monitoring
  participant IConnectionStatsProvider
  MonitoringClient->>Monitoring: ConnectionStats(ConnectionStatsReq)
  Monitoring->>Monitoring: Check access
  Monitoring->>IConnectionStatsProvider: Snapshot()
  IConnectionStatsProvider-->>Monitoring: Connection snapshots
  Monitoring-->>MonitoringClient: ConnectionStatsResp

Merge Risk: 🟡 Moderate · up to 1692c

The observability dashboard now shows client connection names and remote endpoints to any user who can read basic statistics. Before this change, that data was protected by a separate permission that the default policy does not grant. This exposure should be fixed or explicitly accepted before merging. Separately, when replication statistics are denied or fail, the dashboard shows "no active connections" instead of the actual reason.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{A rabbit checks the network lines,
And counts the bytes as daylight shines.
Replication queues now share the view,
While live connections come through.
The old TCP page hops away,
New stats greet the burrow today.}

_{Comment @coderabbitai help to get the list of available commands.}