policy, config, web: the TCP gauges named once, one revalidator, one peer-naming rule

A code-quality pass over policy, configuration and the status API.
The twenty TCP gauges were spelled out in the struct, the
constructor, the removal, the sampler in the web crate and the status
view; one macro names each once with its help text, `PeerTcp::set`
fills them from a connection, and the view is a `From`. Every metric
and the list that forces them at start come from one declaration,
with a test that every declared family is registered. The two
revalidators, for next hops and for RPKI, share the task body that
scans the table off the sessions' threads and fans the findings out
to every session; the RPKI scan judges a route with the same `Checks`
the import path uses. Which peer a query names is one rule for the
received, rejected and TCP endpoints, so `/api/tcp` takes a name or an
address like the others. The config parser says proto3's "zero is
unset" in three helpers instead of a dozen shapes, and `parse_peer`
is three named parts shorter. The policy's test-only next-hop flag is
named for what it does, `accept_own_host_next_hop`; the "listed, or
else ours" prefix rule and the mark-then-prefer step each exist once.
The status page derives its spanning rows from the table's header,
shares one key-value grid and one detail-row rule, and defines its
helpers before their use. The web crate no longer re-exports views
nothing uses, and the TCP endpoint sits above the test module.

Testing: the TCP view's arithmetic (a share of no busy time is zero,
not NaN), the peer-naming rule, the RPKI scan finding only what a
change can have made invalid, and `/api/tcp` by address, by name and
for an unknown peer. The server and web tests, the HTTP, roles, RPKI
and import-policy integration tests, the docs build and every lab
phase pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/integration-tests/tests/http_api.rs

@@ -52,6 +52,27 @@ async fn test_status_and_peers() -> Result<()> {
         peers[0]["address_families"],
         serde_json::json!(["IPv4 unicast", "IPv6 unicast"])
     );
+
+    // The session's TCP connection, by the address the peer list gives.
+    // What the kernel says of it depends on the platform; that it was
+    // asked, and why it had nothing to say if it had not, does not.
+    let peer_addr = peers[0]["peer_addr"].as_str().unwrap();
+    let tcp = get_json(&client, &format!("{base}/api/tcp?peer={peer_addr}")).await?;
+    let available = tcp["available"].as_bool().expect("available is a bool");
+    if available {
+        assert!(tcp["connection"].is_object(), "{tcp}");
+    } else {
+        assert!(tcp["reason"].is_string(), "{tcp}");
+    }
+    // The address alone names the peer too, as it does elsewhere.
+    let by_address = get_json(&client, &format!("{base}/api/tcp?peer=127.0.0.1")).await?;
+    assert_eq!(by_address["available"], tcp["available"]);
+    // A peer there is no session with is a bad request, not an answer.
+    let nobody = client
+        .get(format!("{base}/api/tcp?peer=nobody"))
+        .send()
+        .await?;
+    assert_eq!(nobody.status(), 400);
     Ok(())
 }