p2p/discover: evict unresponsive nodes topdisc

[srene]

Removes nodes that have gone away from the topic-discovery state. Failures are observed where topic RPC responses are already handled — on the goroutine that owns each state — so there is no global failure tracking and no shared counters.

Event	Reg tables	Search table	Ad cache
REGTOPIC timeout	attempt removed (this topic)	—	ads removed
TOPICQUERY timeout	attempt removed (all topics)	node removed	ads removed
DHT node removed	attempt removed (all topics)	—	ads removed

Only errTimeout is treated as a liveness signal. A call can also fail with errClosed, which means we cancelled it from our own side — node shutdown, a topic deregistration, or a search iterator Close — so the node's liveness is unknown; it is ignored everywhere and never triggers eviction, matching lookup.go which likewise skips failure recording on cancel.

A timeout is a global liveness signal (the node is dead, not just bad for one topic), so errTimeout in the search loop routes through evictNode — the same fan-out a DHT removal uses — evicting the node from the ad cache and every registration table. The reg loop still handles its own REGTOPIC failures locally (own attempt + ads) rather than via evictNode, to avoid a blocking self-send into its own eviction channel.

Registration table. A failed REGTOPIC drops the attempt via Registration.HandleErrorResponse (pre-existing behavior). New: DHT removals and failed TOPICQUERYs also evict parked attempts (Registration.RemoveNode), because those can sit unprobed for a long time — Standby nodes are never contacted and Registered ones only at ad expiry, so a dead registrar would otherwise squat in its bucket holding a phantom ad. In-flight attempts are left for their pending response handling.

Search table. New Search.HandleErrorResponse: a failed TOPICQUERY evicts the queried node, freeing its bucket slot and IP-limit entry. The failure does not count as a response: the bucket keeps gating the query walk while it has remaining candidates; once they all fail it empties and no longer blocks the walk (#60 semantics), and a search whose nodes all fail becomes IsDone and rolls over. A query that delivered some nodes before erroring is treated as a response (kept, with the error logged). Search tables ignore DHT removals: their state is short-lived and every node in it is queried within seconds.

Ad cache. It has no liveness probe of its own — advertisers are never the target of topic RPCs — so it is cleaned from both external signals: topic RPC timeouts observed by the reg/search loops, and DHT routing-table removals (Table.subscribeRemovedNodes, #21). The DHT-removal signal is drained off removedFeed (sent under the table lock) on a dedicated goroutine that only forwards events to a worker, so the eviction work never backs up the feed under the lock.

Closes #21.