Install best routes in the Linux kernel over netlink

New crate bgp-fib. It follows the routing table's best routes and keeps
the kernel's routing table the same, and learns the machine's interfaces
and addresses from the kernel, which is what says whether a next hop can
be reached.

- netlink: the rtnetlink messages used (routes, addresses, links, errors),
  as bytes and back. No I/O; property tested and fuzzed.
- interfaces: what is directly reachable, and from which interface.
- plan: what to ask the kernel for, given the best routes and what the
  kernel has. No I/O; tested against a model kernel.
- kernel (Linux only): the sockets and the task. Requests go in batches;
  routes of ours found at startup are kept if still right and removed if
  not; a change of interfaces has every route worked out again; a clean
  stop removes our routes.

Only routes marked proto bgp with the configured table and metric are
ever touched. A best route is installed if its next hop is a neighbor;
next hops further away are not resolved through other routes yet, and
such prefixes are counted and shown instead.

Configured with `kernel { table metric }`; off by default. The daemon
needs CAP_NET_ADMIN and stops if the kernel refuses it. On shutdown it
closes sessions and then removes its routes.

/api/kernel and the status page show installed, unresolved and refused
counts, the last error and the interfaces; five bgp_kernel_* metrics.

Testing: scripts/kernel-tests.sh runs, in network namespaces of their
own and with only the capabilities the daemon needs, the installer
against `ip route`, the daemon with a peer, and two daemons that route
for each other with pings across over IPv4 and IPv6.
scripts/linux-vm.sh runs that, or anything else, in a Lima VM from
macOS. CI runs the kernel tests and fuzzes the netlink decoder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Cargo.lock

@@ -185,10 +185,27 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "bgp-fib"
+version = "0.0.2"
+dependencies = [
+ "bgp-packet",
+ "bgp-primitives",
+ "bgp-rib",
+ "bytes",
+ "netlink-sys",
+ "prometheus",
+ "proptest",
+ "thiserror 2.0.12",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "bgp-integration-tests"
 version = "0.0.2"
 dependencies = [
+ "bgp-fib",
  "bgp-packet",
  "bgp-primitives",
  "bgp-rib",
@@ -266,6 +283,7 @@ dependencies = [
 name = "bgp-server"
 version = "0.0.2"
 dependencies = [
+ "bgp-fib",
  "bgp-packet",
  "bgp-primitives",
  "bgp-rib",
@@ -289,6 +307,7 @@ name = "bgp-web"
 version = "0.0.2"
 dependencies = [
  "axum",
+ "bgp-fib",
  "bgp-packet",
  "bgp-primitives",
  "bgp-rib",
@@ -961,6 +980,19 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "netlink-sys"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd6c30ed10fa69cc491d491b85cc971f6bdeb8e7367b7cde2ee6cc878d583fae"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "libc",
+ "log",
+ "tokio",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"