Rework the speaker: sans-I/O FSM, sharded table, RFC 7606, ADD-PATH

The work of the speaker-cleanup branch as one commit; the branch keeps
the step-by-step history.

Sessions
- The state machine is a pure function from events to actions, driven by
  one task per connection. Idle, Connect and Active belong to a dialer
  that keeps configured peers up with backoff.
- Capabilities are negotiated: address families, four-octet AS numbers
  with AS_TRANS and AS4_PATH, route refresh, ADD-PATH per family and
  direction.
- Collision detection per RFC 4271 section 6.8, by address and
  identifier.
- Connections are taken only from configured peers, a few per address.
- A panic in a session is contained and answered with a Cease; a core
  task that stops shuts the server down with a Cease to every peer.
- Writes that make no progress are given up (RFC 9687).

Codec
- Malformed UPDATEs are handled as RFC 7606 says: treat-as-withdraw,
  attribute discard, or session reset, with the NOTIFICATION to send.
- Address families are open types; any can be named and ignored.
- Prefixes are fixed-size values, normalised, with path identifiers.
- Lengths are filled in after writing; one definition of each type code.
- Property tests and fuzz targets for every decoder.

Routing table
- Adj-RIBs-In and Loc-RIB in one sharded table that sessions write to
  directly. Routes are sixteen bytes; attribute sets are interned in
  wire form. Best-path selection per RFC 4271 section 9.1.2.2 with
  deterministic MED.
- A journal per shard lets followers read changes at their own pace;
  one that falls behind is resynchronised.
- On a RIPE RIS dump of 148 peers and 39.3M routes: loaded in 2.0 s on
  12 cores, about 52 bytes a route.

Announcing
- Originated routes come from the configuration. Each session has its
  own exporter with an Adj-RIB-Out, so a slow peer delays only itself.
- Routes to a peer in our own AS have an empty path and a LOCAL_PREF.

Operations
- HTTP status page, JSON API, event stream and Prometheus metrics.
- Benchmarks on synthetic and real tables.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bin/bgp/README.md

@@ -1,9 +1,65 @@
 # BGP
 
-This crate provides a binary which runs the Border Gateway Protocol (BGP).
+This crate provides the `bgp` binary, which runs the Border Gateway Protocol
+daemon together with its read-only HTTP status interface.
 
-Please refer to the other implementation crates part of this repository where most of the actual implemntation lives.
+```
+cargo run -- path/to/config.textpb
+```
 
-Warning: This is still very much a work in progress and is not yet ready for use.
+The configuration format is defined in `crates/server/proto/config.proto`;
+`testdata/server.textpb` is a worked example. The daemon is configured
+entirely through that file: peers, and the routes it originates
+(`originate { prefix: ... }`). There is no way to change either at runtime.
 
-The main ongoing work is happening currently in the BGP packet crate.
+When `http_endpoint` is set the binary also serves:
+
+| Path | Purpose |
+|---|---|
+| `GET /statusz` | Status page: configuration, peers and session state, originated and received routes, live event log |
+| `GET /api/status` | Router ID, ASN, uptime and table sizes |
+| `GET /api/config` | The configuration file as read at startup |
+| `GET /api/peers` | Configured peers and established sessions |
+| `GET /api/routes/local` | Originated routes |
+| `GET /api/routes/received` | Adj-RIB-In contents |
+| `GET /api/events` | Server-sent events for session and route changes |
+| `GET /metricz` | Prometheus metrics |
+
+Everything under it is read-only and unauthenticated. Bind it to loopback or
+put it behind a reverse proxy.
+
+## What it does today
+
+It establishes sessions (both dialling configured peers and accepting
+connections, with RFC 4271 collision detection), announces its originated
+routes to every peer with itself as next hop, and records what peers send in
+an Adj-RIB-In. It does not select best paths, re-advertise received routes or
+program a forwarding table, and it has no import or export policy.
+
+## Who may connect
+
+Connections are taken only from the addresses of configured peers, and from
+each of those only a few at a time. Anything else is closed unread and
+counted in `bgp_connections_refused_total`. `accept_unconfigured_peers: true`
+lets any host open a session as any AS; it exists for tests on a closed
+network.
+
+## Trying it without a router
+
+`fake_peer` is a minimal BGP speaker that connects to the daemon, announces a
+prefix, prints every UPDATE it receives and, with `--echo`, re-announces each
+received prefix back with its own ASN prepended (dropping NO_EXPORT routes).
+That makes originated prefixes show up in the received table as if they had
+travelled through a neighbouring AS:
+
+```
+cargo run -- testdata/server.textpb
+cargo run -p bgp-integration-tests --example fake_peer -- \
+    --server 127.0.0.1:179 --asn 65001 --announce 203.0.113.0/24 --echo
+```
+
+Please refer to the other implementation crates in this repository where most
+of the actual implementation lives.
+
+Warning: This is still very much a work in progress and is not yet ready for
+production use.