Take every down peer out of the table in one walk (closes #225)

The prefix handler ran one PeerDown per peer, one after another. When
the sessions of several peers went down together, their walks queued up.
A returning full-table peer's messages stayed held back while the walks
ahead of its own ran, and could reach the limit of 20,000.

The table's PeersDown now takes several peers out of every prefix in one
walk. One walk runs at a time. The next one takes every peer whose
session went down since the previous one began. The doc of
maxHeldBackMessages says how long a peer's messages are held back. The
limit is now 150,000 messages, about 150 MiB. The status page shows how
many messages each handler holds back.

Model: opus-5-5

TODO.md

@@ -35,6 +35,14 @@ tested.
 
 # Completed Steps
 
+- 2026-11-02: when the sessions of several peers go down, the prefix handler
+  takes the peers out of the routing table together. The table's `PeersDown`
+  takes several peers out of every prefix in one walk. One walk runs at a time.
+  The next one takes every peer whose session went down since the previous one
+  began. Each peer used to have a walk of its own. A peer's messages stayed held
+  back while the walks queued ahead of its own ran. The handler holds back at
+  most 150,000 messages, about 150 MiB. It used to hold back at most 20,000. The
+  status page shows how many messages the handler holds back (closes #225)
 - 2026-11-02: working out the home page's cards no longer stops the prefix
   handler. The walk over the routing table holds the table's lock for 10,000
   prefixes at a time, then lets the lock go for as long again, as `PeerDown`