Rework the speaker: sans-I/O FSM, sharded table, RFC 7606, ADD-PATH

The work of the speaker-cleanup branch as one commit; the branch keeps
the step-by-step history.

Sessions
- The state machine is a pure function from events to actions, driven by
  one task per connection. Idle, Connect and Active belong to a dialer
  that keeps configured peers up with backoff.
- Capabilities are negotiated: address families, four-octet AS numbers
  with AS_TRANS and AS4_PATH, route refresh, ADD-PATH per family and
  direction.
- Collision detection per RFC 4271 section 6.8, by address and
  identifier.
- Connections are taken only from configured peers, a few per address.
- A panic in a session is contained and answered with a Cease; a core
  task that stops shuts the server down with a Cease to every peer.
- Writes that make no progress are given up (RFC 9687).

Codec
- Malformed UPDATEs are handled as RFC 7606 says: treat-as-withdraw,
  attribute discard, or session reset, with the NOTIFICATION to send.
- Address families are open types; any can be named and ignored.
- Prefixes are fixed-size values, normalised, with path identifiers.
- Lengths are filled in after writing; one definition of each type code.
- Property tests and fuzz targets for every decoder.

Routing table
- Adj-RIBs-In and Loc-RIB in one sharded table that sessions write to
  directly. Routes are sixteen bytes; attribute sets are interned in
  wire form. Best-path selection per RFC 4271 section 9.1.2.2 with
  deterministic MED.
- A journal per shard lets followers read changes at their own pace;
  one that falls behind is resynchronised.
- On a RIPE RIS dump of 148 peers and 39.3M routes: loaded in 2.0 s on
  12 cores, about 52 bytes a route.

Announcing
- Originated routes come from the configuration. Each session has its
  own exporter with an Adj-RIB-Out, so a slow peer delays only itself.
- Routes to a peer in our own AS have an empty path and a LOCAL_PREF.

Operations
- HTTP status page, JSON API, event stream and Prometheus metrics.
- Benchmarks on synthetic and real tables.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Cargo.toml

@@ -1,6 +1,8 @@
 [workspace]
 default-members = ["bin/bgp"]
 members = ["bin/*", "crates/*"]
+# Fuzz targets need a nightly toolchain; see fuzz/README.md.
+exclude = ["fuzz"]
 resolver = "3"
 
 [workspace.package]
@@ -9,17 +11,29 @@ description = "A Border Gateway Protocol implementation"
 edition = "2024"
 homepage = "https://rayhaan.ch"
 license = "Apache-2.0"
-name = "bgp"
-repository = "https://git.rayhaan.net/rayhaan/bgp"
+repository = "https://git.rayhaan.net/rayhaan/ferrix"
 version = "0.0.2"
 
+# Every crate opts in with `[lints] workspace = true`. CI turns warnings into
+# errors, so a lint added here is enforced.
+[workspace.lints.rust]
+unsafe_code = "forbid"
+
+[workspace.lints.clippy]
+all = { level = "warn", priority = -1 }
+dbg_macro = "warn"
+todo = "warn"
+unimplemented = "warn"
+
 [workspace.dependencies]
 # --- Our crates ---
 bgp-packet = { path = "crates/packet" }
 bgp-primitives = { path = "crates/primitives" }
 bgp-rib = { path = "crates/rib" }
 bgp-server = { path = "crates/server" }
+bgp-web = { path = "crates/web" }
 bgp-integration-tests = { path = "crates/integration-tests" }
+bgp-bench = { path = "crates/bench" }
 
 # --- General ---
 bitfield = "0.19.0"
@@ -27,6 +41,7 @@ bytes = "1.10.1"
 eyre = "0.6.12"
 nom = "8.0.0"
 serde = { version = "1.0.219", features = ["derive"] }
+socket2 = "0.6"
 serde_json = "1.0.140"
 serde_repr = "0.1.20"
 thiserror = "2.0.12"
@@ -35,7 +50,13 @@ strum = { version = "0.27.1", features = ["derive"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
 prometheus = "0.14.0"
+proptest = "1.7"
 protobuf = { package = "protobuf", version = "3.7.2" }
 protobuf-codegen = { package = "protobuf-codegen", version = "3.7.2" }
 clap = { version = "4.5.53", features = ["derive"] }
+foldhash = "0.2"
 futures = "0.3"
+hashbrown = "0.17"
+axum = "0.8.9"
+tokio-stream = { version = "0.1.19", features = ["sync"] }
+reqwest = { version = "0.13.5", default-features = false, features = ["json"] }