Hygiene: scripts, CI, docs and manifests

- scripts/in-namespace.sh set CARGO_TARGET_DIR to the empty string when
  it was unset, which cargo refuses, and dropped RUSTFLAGS, so the run
  in the namespace rebuilt what kernel-tests.sh had just built. Each is
  passed on only where set.
- The README's list of unsupported features still had route reflection
  and graceful restart, both of which exist; the command-line reference
  lacked SIGUSR1 and exit status 75; the HTTP API reference did not say
  what errors look like.
- The event stream said "missed 0 events" for the best-routes stream,
  which does not count what it missed; it leaves the count out now.
- CI lints bgp-bench with its count-memory feature, which nothing built.
- bgp-bench had two unused dev-dependencies; bgp-integration-tests had
  three dependencies that only its tests and examples use.
- install.sh updates apt before installing; two-routers.sh loses an
  unused variable; small things in the web crate.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/content/docs/reference/command-line.md

@@ -32,8 +32,9 @@ validates the file.
 
 | Status | Meaning |
 |---|---|
-| 0 | With `--check`: the configuration is valid. Otherwise: the daemon stopped in response to a signal. |
+| 0 | With `--check`: the configuration is valid. Otherwise: the daemon stopped in response to `SIGTERM` or `SIGINT`. |
 | 1 | The configuration is invalid, or the daemon failed. The error is written to standard error. |
+| 75 | The daemon exited in response to `SIGUSR1`, to be started again. The systemd unit restarts it on this status (`RestartForceExitStatus=75`). See [Upgrading Ferrix](@/docs/operations/deployment.md#upgrading-ferrix). |
 
 ## Environment Variables
 
@@ -45,7 +46,8 @@ validates the file.
 
 | Signal | Action |
 |---|---|
-| `SIGTERM`, `SIGINT` | Sends a Cease NOTIFICATION message with the subcode Administrative Shutdown to every neighbor, removes the daemon's routes from the kernel, and exits. |
+| `SIGTERM`, `SIGINT` | Sends a Cease NOTIFICATION message with the subcode Administrative Shutdown to every neighbor, removes the daemon's routes from the kernel, and exits with status 0. |
+| `SIGUSR1` | Starts a graceful restart (RFC 4724): neighbors on which graceful restart is in use retain the routes of Ferrix for the restart time, other neighbors receive a Cease NOTIFICATION message with the subcode Administrative Shutdown, the routes stay in the kernel, and the daemon exits with status 75. See [Upgrading Ferrix](@/docs/operations/deployment.md#upgrading-ferrix). |
 
 Ferrix does not reload its configuration while it runs. To apply a new
 configuration, restart the daemon. See

docs/content/docs/reference/http-api.md

@@ -8,9 +8,16 @@ nav = "HTTP API"
 +++
 
 Ferrix serves its HTTP interface on the address configured with
-`http_endpoint`. All endpoints are read-only and use the `GET` method. If a
-query parameter is invalid, the server returns status 400 (Bad Request)
-with a description of the error.
+`http_endpoint`. All endpoints are read-only and use the `GET` method.
+
+An error response has a `text/plain` body that describes the error. The
+server returns the following error statuses:
+
+| Status | Meaning |
+|---|---|
+| 400 (Bad Request) | A query parameter is invalid. |
+| 500 (Internal Server Error) | The server could not produce the response, for example because the metrics could not be encoded. |
+| 503 (Service Unavailable) | A table is unavailable because the daemon is shutting down. |
 
 > [!CAUTION]
 > The HTTP interface does not require authentication. Bind it to a loopback
@@ -229,7 +236,7 @@ identifies the event, as listed in Table 2.
 | `local_announced`, `local_withdrawn` | An originated route was advertised or withdrawn. |
 | `best_changed` | The best path for a prefix changed. The `route` field contains the new best path. |
 | `best_withdrawn` | A prefix no longer has a route. |
-| `lagged` | The client did not read events quickly enough and missed events on `stream`. Reload the corresponding table. |
+| `lagged` | The client did not read events quickly enough and missed events on `stream`. Reload the corresponding table. The `missed` field gives the number of missed events for the `sessions` and `local_routes` streams; the `best_routes` stream omits it because the number is not known. |
 
 The following command displays the event stream: