Take every down peer out of the table in one walk (closes #225)

The prefix handler ran one PeerDown per peer, one after another, and
stopped taking messages at 20,000 held-back messages. Sessions going
down together queued up their walks, so a returning full-table peer
could reach that limit.

The table's PeersDown now takes several peers out of every prefix in
one walk. One walk runs at a time. The next one takes every peer whose
session went down meanwhile, so a message is held back for two walks at
most. Each walk takes about 2.6 seconds for each full-table peer it
takes out. The limit is now 150,000 messages, about 150 MiB: enough
when four full-table peers go down together. The status page shows how
many messages each handler holds back.

Model: opus-5-5

internal/templates/status.html

@@ -541,6 +541,10 @@
                         <span class="metric-label">Dropped</span>
                         <span class="metric-value ${handler.dropped_count > 0 ? 'disconnected' : ''}">${formatNumber(handler.dropped_count)}</span>
                     </div>
+                    <div class="metric">
+                        <span class="metric-label">Held Back</span>
+                        <span class="metric-value">${formatNumber(handler.held_back_count)}</span>
+                    </div>
                     <div class="metric">
                         <span class="metric-label">Avg Time</span>
                         <span class="metric-value">${formatProcessingTime(handler.avg_process_time_ms)}</span>