Fix the origin-changes review findings

Hold the 100,000-row cap after a failed write's rows are put back, dropping and counting the oldest rows past it. Stop counts the unwritten origin changes. The prefix handler's per-write origin change limit is a field, so a test checks that one write leaves the rest. The server and README now say where origin changes come from. README, TODO and schema say 72 hours or 500 rows, whichever keeps more. The prefix page and TODO list the origin change columns and say what the peer count counts. The page takes its 5,000-row note from the constant.

Model: deepseek-v4-pro

internal/routetable/originchanges.go

@@ -7,7 +7,8 @@ import (
 )
 
 // maxWaitingOriginChanges is the most origin changes the table keeps waiting
-// for the prefix handler to write. A change past it is dropped and counted.
+// for the prefix handler to write. The oldest change past it is dropped and
+// counted.
 const maxWaitingOriginChanges = 100000
 
 // OriginChange is one change of a prefix and origin AS pair: the origin AS
@@ -39,13 +40,8 @@ func (t *Table) recordOriginChange(
 		Time:      t.now(),
 	}
 
-	if len(t.originChanges) == maxWaitingOriginChanges {
-		// The oldest change is dropped to make room.
-		t.originChanges = t.originChanges[1:]
-		t.originChangesDropped++
-	}
-
 	t.originChanges = append(t.originChanges, change)
+	t.trimOriginChanges()
 }
 
 // TakeOriginChanges returns at most limit of the origin changes that wait to
@@ -67,12 +63,31 @@ func (t *Table) TakeOriginChanges(limit int) ([]OriginChange, int) {
 
 // PutBackOriginChanges records again what one TakeOriginChanges call returned,
 // for a caller that could not write it. The next TakeOriginChanges returns
-// those changes first, before the ones that arrived since.
+// those changes first, before the ones that arrived since. The oldest changes
+// past the cap are dropped and counted.
 func (t *Table) PutBackOriginChanges(changes []OriginChange) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
 	t.originChanges = append(changes, t.originChanges...)
+	t.trimOriginChanges()
+}
+
+// trimOriginChanges drops the oldest origin changes past the cap and counts
+// them. The caller holds the lock.
+func (t *Table) trimOriginChanges() {
+	if extra := len(t.originChanges) - maxWaitingOriginChanges; extra > 0 {
+		t.originChangesDropped += extra
+		t.originChanges = t.originChanges[extra:]
+	}
+}
+
+// OriginChangeCount returns how many origin changes wait for TakeOriginChanges.
+func (t *Table) OriginChangeCount() int {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+
+	return len(t.originChanges)
 }
 
 // prefixPeerCount returns how many peers carry prefix, counting every origin