Take every down peer out of the table in one walk (closes #225)

The prefix handler ran one PeerDown per peer, one after another, and
stopped taking messages at 20,000 held-back messages. Sessions going
down together queued up their walks, so a returning full-table peer
could reach that limit.

The table's PeersDown now takes several peers out of every prefix in
one walk. One walk runs at a time. The next one takes every peer whose
session went down meanwhile, so a message is held back for two walks at
most. Each walk takes about 2.6 seconds for each full-table peer it
takes out. The limit is now 150,000 messages, about 150 MiB: enough
when four full-table peers go down together. The status page shows how
many messages each handler holds back.

Model: opus-5-5

internal/database/database_internal_test.go

@@ -273,7 +273,7 @@ func TestVacuumReturnsFreePages(t *testing.T) {
 	writeTableChanges(t, db, table)
 
 	// The peer going down removes every prefix, and so every row.
-	table.PeerDown(peerA)
+	table.PeersDown([]string{peerA})
 	writeTableChanges(t, db, table)
 
 	var before int

internal/database/routes_internal_test.go

@@ -107,7 +107,7 @@ func TestReadRouteTableGivesBackWhatWasWritten(t *testing.T) {
 
 	// A peer moves to another origin, one goes down and a new one comes.
 	announceTo(source, tablePrefixV4, asB, peerA, 60)
-	source.PeerDown(peerC)
+	source.PeersDown([]string{peerC})
 	announceTo(source, tablePrefixV6, asB, peerE, 70)
 
 	writeTableChanges(t, db, source)
@@ -133,7 +133,7 @@ func TestReadRouteTableGivesATableThatTakesLaterUpdates(t *testing.T) {
 	// another one goes down, and a new peer comes.
 	for _, table := range []*routetable.Table{source, read} {
 		table.Withdraw(netip.MustParsePrefix(tablePrefixV4), peerA)
-		table.PeerDown(peerB)
+		table.PeersDown([]string{peerB})
 		announceTo(table, tablePrefixShortV4, asB, peerD, 50)
 	}