Look routes up, and see and alert on the ones that were refused

Two things were hard to find out from the status page and the API: what
the table has for a given prefix or address, and what a peer announced
that was refused and why.

Looking up. /api/routes/received takes a query, and the status page has
a box for it:
- prefix: every route for that prefix, the best first;
- address: every prefix that covers the address, most specific first;
- within: a prefix and everything inside it;
- peer (by name or address) and best narrow any of these.
A query that makes no sense is answered 400 with the reason, which the
page shows. Results come in address order. Routes are shown with the
peer's configured name.

Refused routes. A refused route is not stored, so until now there was
only a count. For each peer the server now keeps how many routes were
refused for each reason, and the latest 200 with the AS path they came
with. The record is kept by the peer's address and outlives the
session, so that a peer that was cut off can still be looked into. It is
at /api/routes/rejected and in a new section of the status page; the
peers table links to it.

Alerting. bgp_routes_rejected_total is now by peer as well as reason.
New: bgp_peer_routes and bgp_peer_max_prefixes, to see a peer nearing
its limit, and bgp_prefix_limit_exceeded_total. The README has rules to
start from. The log has a line for a peer's first refused route and
then at most one a minute, with the count of the others.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/web/src/lib.rs

@@ -19,11 +19,15 @@ use axum::response::{Html, IntoResponse, Redirect};
 use axum::routing::get;
 use bgp_rib::LocalRib;
 use bgp_rib::table::RibTable;
+use bgp_server::refusals::RefusalLog;
 use bgp_server::session::SessionRegistry;
 use tokio::net::TcpListener;
 use tracing::info;
 
-pub use api::{AttrSummary, ConfigView, LocalRouteView, PeerView, ReceivedRouteView, StatusView};
+pub use api::{
+    AttrSummary, ConfigView, LocalRouteView, PeerView, ReceivedRouteView, RefusalsView,
+    RefusedRouteView, StatusView,
+};
 
 /// Static facts about the router shown in status output.
 #[derive(Debug, Clone)]
@@ -81,6 +85,8 @@ pub struct AppState {
     pub local_rib: LocalRib,
     /// The routing table: routes learned from peers and the best of them.
     pub rib: Arc<RibTable>,
+    /// What peers announced that was not taken.
+    pub refusals: RefusalLog,
 }
 
 /// The status page, embedded so the binary is self-contained.
@@ -103,6 +109,7 @@ pub fn router(state: AppState) -> Router {
         .route("/api/peers", get(api::peers))
         .route("/api/routes/local", get(api::local_routes))
         .route("/api/routes/received", get(api::received_routes))
+        .route("/api/routes/rejected", get(api::rejected_routes))
         .route("/api/events", get(events::stream))
         .route("/metricz", get(metrics::metricz))
         .with_state(state)