Rework the speaker: sans-I/O FSM, sharded table, RFC 7606, ADD-PATH

The work of the speaker-cleanup branch as one commit; the branch keeps
the step-by-step history.

Sessions
- The state machine is a pure function from events to actions, driven by
  one task per connection. Idle, Connect and Active belong to a dialer
  that keeps configured peers up with backoff.
- Capabilities are negotiated: address families, four-octet AS numbers
  with AS_TRANS and AS4_PATH, route refresh, ADD-PATH per family and
  direction.
- Collision detection per RFC 4271 section 6.8, by address and
  identifier.
- Connections are taken only from configured peers, a few per address.
- A panic in a session is contained and answered with a Cease; a core
  task that stops shuts the server down with a Cease to every peer.
- Writes that make no progress are given up (RFC 9687).

Codec
- Malformed UPDATEs are handled as RFC 7606 says: treat-as-withdraw,
  attribute discard, or session reset, with the NOTIFICATION to send.
- Address families are open types; any can be named and ignored.
- Prefixes are fixed-size values, normalised, with path identifiers.
- Lengths are filled in after writing; one definition of each type code.
- Property tests and fuzz targets for every decoder.

Routing table
- Adj-RIBs-In and Loc-RIB in one sharded table that sessions write to
  directly. Routes are sixteen bytes; attribute sets are interned in
  wire form. Best-path selection per RFC 4271 section 9.1.2.2 with
  deterministic MED.
- A journal per shard lets followers read changes at their own pace;
  one that falls behind is resynchronised.
- On a RIPE RIS dump of 148 peers and 39.3M routes: loaded in 2.0 s on
  12 cores, about 52 bytes a route.

Announcing
- Originated routes come from the configuration. Each session has its
  own exporter with an Adj-RIB-Out, so a slow peer delays only itself.
- Routes to a peer in our own AS have an empty path and a LOCAL_PREF.

Operations
- HTTP status page, JSON API, event stream and Prometheus metrics.
- Benchmarks on synthetic and real tables.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

testdata/server.textpb

@@ -1,10 +1,43 @@
+# A worked example; the fields are documented in
+# crates/server/proto/config.proto.
 router_id: "10.0.0.1"
 local_asn: 65000
-listen_endpoints {
-    address: "127.0.0.1"
-    port: 179
+
+# Where to accept BGP connections. Port 179 needs privileges; pick another
+# port to run unprivileged against a peer that dials a custom port.
+listen_endpoints { address: "127.0.0.1" port: 179 }
+listen_endpoints { address: "::1" port: 179 }
+
+# A peer we connect to and accept connections from. Connections from any
+# other address are closed unread, unless accept_unconfigured_peers is set,
+# which is for a closed test network only.
+peers {
+    name: "r1"
+    endpoint { address: "127.0.0.1" port: 1791 }
+    remote_asn: 65001
+    hold_time_seconds: 30
+    # Offer only these families to the peer. Left out, all are offered.
+    address_families: IPV4_UNICAST
+    address_families: IPV6_UNICAST
+    # Take several routes for a prefix from this peer, if it offers to send
+    # them (ADD-PATH). Also ADD_PATH_SEND and ADD_PATH_BOTH. Off by default.
+    add_path: ADD_PATH_RECEIVE
 }
-listen_endpoints {
-    address: "[::1]"
-    port: 179
+connect_retry_seconds: 5
+
+# Let a restarted peer replace a stale Established session immediately
+# (RFC 4271 CollisionDetectEstablishedState). Default false.
+collision_detect_established_state: false
+
+# Routes this router originates, announced to every peer.
+originate { prefix: "10.100.0.0/16" }
+originate {
+    prefix: "2001:db8:100::/48"
+    med: 50
+    communities: "65000:100"
+    large_communities: "65000:1:2"
 }
+
+# Read-only status page, JSON API and metrics. It has no authentication:
+# keep it on loopback or behind a reverse proxy.
+http_endpoint { address: "127.0.0.1" port: 8080 }