Fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check

The acquire-time expiry check destroyed expired connections without
incrementing lifetimeDestroyCount, unlike the equivalent checks in
Conn.Release and checkConnsHealth. This undercounted retired connections
in pool stats and made TestPoolAcquireDestroysExpiredIdleConn fail.

Also move the expiry check ahead of the ping so an expired connection is
destroyed without first incurring a wasted ping round-trip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jackc

pgxpool/pool.go

@@ -619,6 +619,15 @@ func (p *Pool) Acquire(ctx context.Context) (c *Conn, err error) {
 
 		cr := res.Value()
 
+		// Destroy expired connections before doing any further work (such as
+		// pinging) on them. This enforces MaxConnLifetime at acquire time so that
+		// a connection that expired while idle on a busy pool is not handed out.
+		if p.isExpired(res) {
+			atomic.AddInt64(&p.lifetimeDestroyCount, 1)
+			res.Destroy()
+			continue
+		}
+
 		shouldPingParams := ShouldPingParams{Conn: cr.conn, IdleDuration: res.IdleDuration()}
 		if p.shouldPing(ctx, shouldPingParams) {
 			err := func() error {
@@ -636,11 +645,6 @@ func (p *Pool) Acquire(ctx context.Context) (c *Conn, err error) {
 			}
 		}
 
-		if isExpired := p.isExpired(res); isExpired {
-			res.Destroy()
-			continue
-		}
-
 		if p.prepareConn != nil {
 			ok, err := p.prepareConn(ctx, cr.conn)
 			if !ok {