Install best routes in the Linux kernel over netlink

New crate bgp-fib. It follows the routing table's best routes and keeps
the kernel's routing table the same, and learns the machine's interfaces
and addresses from the kernel, which is what says whether a next hop can
be reached.

- netlink: the rtnetlink messages used (routes, addresses, links, errors),
  as bytes and back. No I/O; property tested and fuzzed.
- interfaces: what is directly reachable, and from which interface.
- plan: what to ask the kernel for, given the best routes and what the
  kernel has. No I/O; tested against a model kernel.
- kernel (Linux only): the sockets and the task. Requests go in batches;
  routes of ours found at startup are kept if still right and removed if
  not; a change of interfaces has every route worked out again; a clean
  stop removes our routes.

Only routes marked proto bgp with the configured table and metric are
ever touched. A best route is installed if its next hop is a neighbor;
next hops further away are not resolved through other routes yet, and
such prefixes are counted and shown instead.

Configured with `kernel { table metric }`; off by default. The daemon
needs CAP_NET_ADMIN and stops if the kernel refuses it. On shutdown it
closes sessions and then removes its routes.

/api/kernel and the status page show installed, unresolved and refused
counts, the last error and the interfaces; five bgp_kernel_* metrics.

Testing: scripts/kernel-tests.sh runs, in network namespaces of their
own and with only the capabilities the daemon needs, the installer
against `ip route`, the daemon with a peer, and two daemons that route
for each other with pings across over IPv4 and IPv6.
scripts/linux-vm.sh runs that, or anything else, in a Lima VM from
macOS. CI runs the kernel tests and fuzzes the netlink decoder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/web/src/lib.rs

@@ -17,6 +17,7 @@ use axum::Router;
 use axum::http::header;
 use axum::response::{Html, IntoResponse, Redirect};
 use axum::routing::get;
+use bgp_fib::Fib;
 use bgp_rib::LocalRib;
 use bgp_rib::table::RibTable;
 use bgp_rpki::Rpki;
@@ -26,7 +27,7 @@ use tokio::net::TcpListener;
 use tracing::info;
 
 pub use api::{
-    AttrSummary, ConfigView, LocalRouteView, PeerView, ReceivedRouteView, RefusalsView,
+    AttrSummary, ConfigView, KernelView, LocalRouteView, PeerView, ReceivedRouteView, RefusalsView,
     RefusedRouteView, RoutesPage, RpkiView, StatusView,
 };
 
@@ -90,6 +91,8 @@ pub struct AppState {
     pub refusals: RefusalLog,
     /// The data for route origin validation, where that is configured.
     pub rpki: Option<Rpki>,
+    /// What keeps the best routes in the kernel, where that is configured.
+    pub kernel: Option<Fib>,
 }
 
 /// The status page, embedded so the binary is self-contained.
@@ -114,6 +117,7 @@ pub fn router(state: AppState) -> Router {
         .route("/api/routes/received", get(api::received_routes))
         .route("/api/routes/rejected", get(api::rejected_routes))
         .route("/api/rpki", get(api::rpki))
+        .route("/api/kernel", get(api::kernel))
         .route("/api/events", get(events::stream))
         .route("/metricz", get(metrics::metricz))
         .with_state(state)