feat(web): clamp IPv4 TTL / IPv6 hop limit on xtcp2's TCP listeners

[randomizedcoder]

Summary

Adds an opt-in per-listener IPv4 TTL / IPv6 hop-limit clamp on xtcp2's own TCP listeners, so their replies can't travel far if the host is unexpectedly internet-exposed. It's the per-listener analogue of a host-level nftables TTL clamp, and mirrors prometheus/exporter-toolkit#396.

What

• pkg/ipsockopt — a net.ListenConfig.Control callback that setsockopts IP_TTL / IPV6_UNICAST_HOPS on the listening socket (the kernel inherits it onto accepted connections). Returns nil when both are 0 so the kernel default is kept; swallows ENOPROTOOPT for the address family the option doesn't apply to.
• Config: ipv4_ttl (184) + ipv6_hop_limit (185) on XtcpConfig — 0 = kernel default, validated <= 255. Flags -ipv4Ttl / -ipv6HopLimit, env IPV4_TTL / IPV6_HOP_LIMIT.
• Applied to both host-exposed listeners:
  • the Prometheus /metrics server — cmd/xtcp2 now does net.Listen + srv.Serve (instead of srv.ListenAndServe) so the option can be set on the socket before bind;
  • the gRPC server (grpc_server.go).

Verification

go test ./pkg/ipsockopt/         # binds real v4/v6 listeners, getsockopt-verifies TTL/hops
nix build .#xtcp2-s3parquet      # -help shows -ipv4Ttl / -ipv6HopLimit
nix build .#test-cmd-xtcp2       # env + buildConfig cover the new knobs
nix build .#test-go-flavor-s3parquet

Default 0 → no behavior change for existing deployments; the clamp only applies when a value is set. (Only TTL + hop-limit here; exporter-toolkit#396 also does DSCP, which I skipped as it's per-connection and not needed for this use case.)

🤖 Generated with Claude Code