Look routes up, and see and alert on the ones that were refused

Two things were hard to find out from the status page and the API: what
the table has for a given prefix or address, and what a peer announced
that was refused and why.

Looking up. /api/routes/received takes a query, and the status page has
a box for it:
- prefix: every route for that prefix, the best first;
- address: every prefix that covers the address, most specific first;
- within: a prefix and everything inside it;
- peer (by name or address) and best narrow any of these.
A query that makes no sense is answered 400 with the reason, which the
page shows. Results come in address order. Routes are shown with the
peer's configured name.

Refused routes. A refused route is not stored, so until now there was
only a count. For each peer the server now keeps how many routes were
refused for each reason, and the latest 200 with the AS path they came
with. The record is kept by the peer's address and outlives the
session, so that a peer that was cut off can still be looked into. It is
at /api/routes/rejected and in a new section of the status page; the
peers table links to it.

Alerting. bgp_routes_rejected_total is now by peer as well as reason.
New: bgp_peer_routes and bgp_peer_max_prefixes, to see a peer nearing
its limit, and bgp_prefix_limit_exceeded_total. The README has rules to
start from. The log has a line for a peer's first refused route and
then at most one a minute, with the count of the others.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/rib/src/table/mod.rs

@@ -533,10 +533,19 @@ impl RibTable {
     /// particular order. For showing some of a table that is too large to
     /// show all of.
     pub fn some_routes(&self, limit: usize) -> Vec<Route> {
+        self.routes_where(limit, |_| true)
+    }
+
+    /// Up to `limit` of the routes that `wanted` picks, in no particular
+    /// order. This looks at routes until it has enough, which for a choosy
+    /// `wanted` is every route in the table: it is for looking into the
+    /// table by hand, not for anything done often. `wanted` is called with
+    /// a shard held and must not call into the table.
+    pub fn routes_where(&self, limit: usize, wanted: impl Fn(&RouteRef<'_>) -> bool) -> Vec<Route> {
         let mut routes = Vec::new();
         for shard in &self.shards {
             for row in &read(shard).rows {
-                for route in row.routes() {
+                for route in row.routes().filter(&wanted) {
                     if routes.len() == limit {
                         return routes;
                     }