fix(evmrpc): limit listener max open connections, configurable via max_open_connections (PLT-704)

[amir-deris]

Describe your changes and provide context

Bounds the number of simultaneously accepted connections on the EVM JSON-RPC HTTP (:8545) and WebSocket (:8546) listeners to protect nodes from connection exhaustion (fd/goroutine pressure) under load or abuse.

• Wrap the listener returned by net.Listen in Start() with netutil.LimitListener(l, maxOpenConns). Excess connections wait in the accept queue until an active connection closes.
• Expose max_open_connections as an operator config field in evmrpc/config (evm.max_open_connections in app.toml), wired through ReadConfig and the config template.
• Add HTTPServer.SetMaxOpenConns, set from config in both NewEVMHTTPServer and NewEVMWebSocketServer before the listener starts.
• The limit is applied per listener (HTTP and WS each get their own budget).
• Default is 2000. Set to 0 to disable the limit (unbounded, prior behavior). The wrap is guarded on maxOpenConns > 0, since netutil.LimitListener would otherwise block all connections at 0.

Testing performed to validate your change

• TestMaxOpenConns (evmrpc): with a cap of 1, verifies a second connection is not served while the first holds the only slot, and is served once the first closes.
• Updated evmrpc/config tests for the new field; go test ./evmrpc/... ./evmrpc/config/... passes.
• go build ./evmrpc/... and gofmt -s clean.

[cursor]

PR Summary

Medium Risk
Changes default RPC availability under heavy connection churn (2000 cap per port); misconfiguration to a very low value could block legitimate clients, but behavior is tunable and 0 preserves prior unbounded behavior.

Overview
Adds operator-configurable connection caps on EVM JSON-RPC HTTP and WebSocket listeners to reduce fd/goroutine exhaustion under load or abuse.

max_open_connections (evm.max_open_connections in app.toml, default 2000) is read via ReadConfig and applied per listener when NewEVMHTTPServer and NewEVMWebSocketServer call SetMaxOpenConns before Start(). In Start(), the TCP listener is wrapped with netutil.LimitListener when the value is > 0; excess clients wait in the accept queue until a slot frees. 0 skips the wrap and restores unbounded accepts.

TestMaxOpenConns asserts that with a cap of 1, a second connection is not served until the first closes.

^{Reviewed by Cursor Bugbot for commit b300366. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 24, 2026, 6:13 PM

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.15%. Comparing base (c528303) to head (b300366).

Files with missing lines	Patch %	Lines
evmrpc/config/config.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3637      +/-   ##
==========================================
- Coverage   59.12%   58.15%   -0.97%     
==========================================
  Files        2259     2176      -83     
  Lines      186489   176903    -9586     
==========================================
- Hits       110255   102880    -7375     
+ Misses      66353    64930    -1423     
+ Partials     9881     9093     -788     

Flag	Coverage Δ
sei-chain-pr	68.64% <81.81%> (?)
sei-db	70.41% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
evmrpc/rpcstack.go	79.00% <100.00%> (+0.45%)	⬆️
evmrpc/server.go	88.67% <100.00%> (+0.10%)	⬆️
evmrpc/config/config.go	70.76% <33.33%> (-0.89%)	⬇️

... and 83 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.