fix(cmd): prevent test DB connection leak via app.Before config swap

TestShell_BeforeNode and TestShell_RunNode_WithBeforeNode were calling
app.Before(c) after pre-setting shell.Config with a txdb-wrapped config
via configtest.NewGeneralConfig. app.Before unconditionally ran
opts.New() → CoreDefaults() which set Database.DriverName back to pgx
and assigned the fresh config to s.Config, silently overwriting the
test's txdb config. BeforeNode → pg.NewLockedDB then opened real pgx
connections against the shared chainlink_test database, persisting
keystore state and leaking it to other tests (flaking Test_CSAKeyStore_E2E)
and eating slots from the server-wide max_connections budget (causing
the mass 25-minute chan-receive timeouts in CORE-2388).

- core/cmd/app.go: guard opts.New() so a pre-set s.Config is preserved.
  Defense-in-depth against any future test hitting the same trap.
- core/cmd/shell_local.go: nil-guard CloseLogger in afterNode (parity
  with app.After; tests calling BeforeNode directly never set it).
- core/cmd/shell_local_test.go: remove the unnecessary app.Before(c)
  calls. Drop the incorrect_password subtests — they were load-bearing
  on the leak; the underlying keystore invariant is covered by
  TestMasterKeystore_Unlock_Save in core/services/keystore.

Refs: CORE-2388, CORE-2370
Supersedes: #21504

Author: Fletch153

core/cmd/app.go

@@ -80,15 +80,20 @@ func NewApp(s *Shell) *cli.App {
 		// logger instead.
 		lggr, closeFn := logger.NewLogger()
 
-		cfg, err := opts.New()
-		if err != nil {
-			return err
-		}
-
 		s.Logger = lggr
 		s.Registerer = prometheus.DefaultRegisterer // use the global DefaultRegisterer, should be safe since we only ever run one instance of the app per shell
 		s.CloseLogger = closeFn
-		s.Config = cfg
+
+		// Preserve a pre-set s.Config. Overwriting it here would clobber
+		// test configs that use a txdb-wrapped driver and cause real pgx
+		// connections to leak into the shared test database.
+		if s.Config == nil {
+			cfg, err := opts.New()
+			if err != nil {
+				return err
+			}
+			s.Config = cfg
+		}
 
 		if c.Bool("json") {
 			s.Renderer = RendererJSON{Writer: os.Stdout}
@@ -122,11 +127,11 @@ func NewApp(s *Shell) *cli.App {
 
 		// Allow for initServerConfig to be called if the flag is provided.
 		if c.Bool("applyInitServerConfig") {
-			cfg, err = initServerConfig(&opts, s.configFiles, s.secretsFiles)
+			serverCfg, err := initServerConfig(&opts, s.configFiles, s.secretsFiles)
 			if err != nil {
 				return err
 			}
-			s.Config = cfg
+			s.Config = serverCfg
 		}
 
 		return nil

core/cmd/shell_local.go

@@ -1241,8 +1241,10 @@ func (s *Shell) afterNode(lggr logger.SugaredLogger) {
 		}
 		lggr.Debug("Closed DB")
 
-		if err := s.CloseLogger(); err != nil {
-			log.Printf("Failed to close Logger: %v", err)
+		if s.CloseLogger != nil {
+			if err := s.CloseLogger(); err != nil {
+				log.Printf("Failed to close Logger: %v", err)
+			}
 		}
 	})
 }

core/cmd/shell_local_test.go

@@ -513,7 +513,6 @@ func TestShell_BeforeNode(t *testing.T) {
 		wantUnlocked bool
 	}{
 		{"correct password", "../internal/fixtures/correct_password.txt", true},
-		{"incorrect password", "../internal/fixtures/incorrect_password.txt", false},
 		{"wrong file", "doesntexist.txt", false},
 	}
 
@@ -543,15 +542,7 @@ func TestShell_BeforeNode(t *testing.T) {
 
 			c := cli.NewContext(nil, set, nil)
 
-			// Create full CLI app and run the Before hook first
-			app := cmd.NewApp(&shell)
-			err := app.Before(c)
-			if err != nil && test.wantUnlocked {
-				t.Fatalf("CLI Before hook failed: %v", err)
-			}
-
-			// Run before hook to initialize components with authentication
-			err = shell.BeforeNode(c)
+			err := shell.BeforeNode(c)
 
 			if test.wantUnlocked {
 				require.NoError(t, err)
@@ -583,7 +574,6 @@ func TestShell_RunNode_WithBeforeNode(t *testing.T) {
 		expectStart bool
 	}{
 		{"correct password", "../internal/fixtures/correct_password.txt", true},
-		{"incorrect password", "../internal/fixtures/incorrect_password.txt", false},
 	}
 
 	for _, test := range tests {
@@ -641,29 +631,18 @@ func TestShell_RunNode_WithBeforeNode(t *testing.T) {
 
 			c := cli.NewContext(nil, set, nil)
 
-			// First initialize components (this includes authentication)
-			cliApp := cmd.NewApp(&shell)
-			err := cliApp.Before(c)
-			require.NoError(t, err)
-
-			err = shell.BeforeNode(c)
+			err := shell.BeforeNode(c)
+			require.NoError(t, err, "BeforeNode should succeed")
+			assert.NotNil(t, shell.KeyStore)
+			assert.NotNil(t, shell.DS)
+			assert.NotNil(t, shell.LDB)
 
-			if test.expectStart {
-				require.NoError(t, err, "BeforeNode should succeed")
-				// Verify components are initialized
-				assert.NotNil(t, shell.KeyStore)
-				assert.NotNil(t, shell.DS)
-				assert.NotNil(t, shell.LDB)
+			// Now test RunNode with pre-authenticated keystore
+			// Note: RunNode will start the app but we expect it to work since keystore is authenticated
+			err = shell.RunNode(c)
+			require.NoError(t, err, "RunNode should succeed with authenticated keystore")
+			assert.Equal(t, 1, apiPrompt.Count, "API should be initialized")
 
-				// Now test RunNode with pre-authenticated keystore
-				// Note: RunNode will start the app but we expect it to work since keystore is authenticated
-				err = shell.RunNode(c)
-				require.NoError(t, err, "RunNode should succeed with authenticated keystore")
-				assert.Equal(t, 1, apiPrompt.Count, "API should be initialized")
-			} else {
-				require.Error(t, err, "BeforeNode should fail with incorrect password")
-				// Don't test RunNode if BeforeNode failed
-			}
 			// Clean up database if it was opened
 			if shell.LDB != nil {
 				cleanupErr := shell.AfterNode(c)