fix(dns): back off on TCP accept errors instead of spinning

When the process runs out of file descriptors, `accept()` returns EMFILE
and leaves the pending connection queued. The error arm logged and looped
straight back into `accept()`, which failed on the same connection
immediately - an unbounded hot loop.

Observed in production on a 1 OCPU host: ~1,600 error lines/second, the
container pegged at 149% CPU, and 65-72% CPU steal. TLS handshakes, the
most CPU-hungry part of the request path, went from ~90ms to 12-18
seconds, with roughly 1 in 5 connections timing out entirely. Plain HTTP
returned empty replies and sshd could not be scheduled reliably.

The spin also starved the very tasks that would have closed descriptors,
so the process could not recover on its own.

Back off 100ms after any accept error. A transient failure now costs a
brief pause rather than the CPU the server needs to recover.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: adrgs

src/src/dns/mod.rs

@@ -36,6 +36,11 @@ const TCP_IDLE_TIMEOUT: Duration = Duration::from_secs(30);
 /// Bound DNS-over-TCP tasks and their socket buffers under connection floods.
 const DNS_TCP_MAX_CONCURRENT_CONNECTIONS: usize = 256;
 
+/// Backoff applied after a resource-exhaustion `accept()` failure (EMFILE/ENFILE).
+/// Without it the failed connection stays queued and `accept()` fails again
+/// immediately, spinning the loop at 100% CPU and starving every other task.
+const TCP_ACCEPT_BACKOFF: Duration = Duration::from_millis(100);
+
 pub(crate) struct DnsRateLimiter {
     limits: Mutex<HashMap<IpAddr, (Instant, u32)>>,
     max_per_second: u32,
@@ -173,7 +178,13 @@ impl Server {
                     });
                 }
                 Err(e) => {
-                    error!("Error accepting DNS TCP connection: {}", e);
+                    // Resource exhaustion (EMFILE/ENFILE) leaves the pending connection
+                    // queued, so returning straight to `accept()` fails on the same
+                    // connection immediately. That spins at 100% CPU and starves the
+                    // very tasks that would release descriptors. Backing off on every
+                    // accept error keeps a transient failure from becoming an outage.
+                    error!("Error accepting DNS TCP connection, backing off: {e}");
+                    tokio::time::sleep(TCP_ACCEPT_BACKOFF).await;
                 }
             }
         }