Dataplane reconcile fixes; LB counters cleanup; SPA scope cookie

Checker / reload:
- Reload's update-in-place branch now mirrors b.Address onto the
  runtime health.Backend. Without this, GetBackend kept returning
  the pre-reload address indefinitely after a config edit that
  touched addresses but not healthcheck settings — the VPP sync
  path reads cfg.Backends directly so the dataplane moved on
  while the gRPC and SPA view stayed wedged on the old IPv4/IPv6.

Sync (internal/vpp/lbsync.go):
- reconcileVIP now detects encap mismatch in addition to
  src-ip-sticky mismatch and takes the full tear-down / re-add
  path via a new shared recreateVIP helper. Triggered when every
  backend flips address family (gre4 <-> gre6) and the existing
  VIP can no longer accept new ASes — previously the sync wedged
  with 'Invalid address family' until a full maglevd restart.
- setASWeight is issued whenever the state machine requests
  flush (a.Flush=true), not only on the weight-value transition
  edge. Fixes the case where a backend reached StateDisabled
  after its effective weight had already been drained to 0 by
  pool failover — the sticky-cache entries pointing at it were
  previously never cleared.

maglev-frontend:
- signal.Ignore(SIGHUP) so a controlling-terminal disconnect
  doesn't kill the daemon.
- debian/vpp-maglev.service grants CAP_SYS_ADMIN in addition to
  CAP_NET_RAW so setns(CLONE_NEWNET) can join the healthcheck
  netns. Comment documents the 'operation not permitted' symptom
  and notes the knob can be dropped if the deployment doesn't use
  the 'netns:' healthcheck option.

LB plugin counters (internal/vpp/lbstats.go + friends):
- Fix the VIP counter regex: the LB plugin registers
  vlib_simple_counter_main_t names without a leading '/'
  (vlib_validate_simple_counter in counter.c:50 uses cm->name
  verbatim; only entries that set cm->stat_segment_name get a
  slash). first/next/untracked/no-server now read through as
  live values instead of zero.
- Drop the per-backend FIB counter block end-to-end (proto,
  grpcapi, metrics, vpp.Client, lbstats, maglevc). Traced from
  lb/node.c:558 into ip{4,6}_forward.h:141 — the LB plugin
  forwards by writing adj_index[VLIB_TX] directly and bypassing
  ip{4,6}_lookup_inline, which is the only path that increments
  lbm_to_counters. The backend's FIB load_balance stats_index
  literally never ticks for LB-forwarded traffic, so the column
  was always zero and misleading. docs/implementation/TODO
  records the full investigation and the recommended upstream
  path (new lb_as_stats_dump API message) for when we're ready
  to carry that VPP patch.
- maglevc show vpp lb counters: plain-text tabular headers.
  label() wraps strings in ANSI escapes (~11 bytes of overhead),
  but tabwriter counts bytes, not rendered width — so a header
  row with label()'d cells and data rows with plain cells drifts
  column alignment on every row. color.go comment now spells
  out the constraint: label() only works when column N is
  wrapped identically in every row (key-value layouts are fine,
  multi-column tables with header-only labelling are not).

SPA:
- stores/scope.ts is cookie-backed (maglev_scope, 1 year,
  SameSite=Lax). App.tsx hydrates from the cookie then validates
  against the fetched snapshots: a cookie referencing a maglevd
  that no longer exists falls through to snaps[0] instead of
  leaving the user on a ghost selection.
- components/Flash.tsx wraps props.value in createMemo. Solid's
  on() fires its callback on every dep notification, not on
  value change — source is right in solid-js/dist/solid.js:460,
  no equality check. Without the memo, flipping scope between
  two 'connected' maglevds (or any other cross-store reactive
  re-eval that doesn't actually change the concrete string)
  replays the animation every time. createMemo's default ===
  dedupe fixes it in one place for every Flash consumer,
  superseding the local createMemo workaround we'd added in
  BackendRow earlier.

cmd/maglevc/commands.go

@@ -337,9 +337,11 @@ func runShowVPPLBState(ctx context.Context, client grpcapi.MaglevClient, _ []str
 	return nil
 }
 
-// runShowVPPLBCounters prints the per-VIP and per-backend runtime counters
-// captured by maglevd's 5s scrape loop. Values are up to 5 seconds stale;
-// Prometheus is the right tool if you need live rates.
+// runShowVPPLBCounters prints the per-VIP runtime counters captured by
+// maglevd's 5s scrape loop. Values are up to 5 seconds stale; Prometheus
+// is the right tool if you need live rates. There is no per-backend
+// block — see internal/vpp/lbstats.go::scrapeLBStats for why VPP's LB
+// plugin doesn't expose per-backend packet counters today.
 func runShowVPPLBCounters(ctx context.Context, client grpcapi.MaglevClient, _ []string) error {
 	ctx, cancel := context.WithTimeout(ctx, callTimeout)
 	defer cancel()
@@ -348,52 +350,30 @@ func runShowVPPLBCounters(ctx context.Context, client grpcapi.MaglevClient, _ []
 		return err
 	}
 
-	if len(resp.Vips) == 0 && len(resp.Backends) == 0 {
+	if len(resp.Vips) == 0 {
 		fmt.Println("(no counters — VPP disconnected or scrape pending)")
 		return nil
 	}
 
 	// ---- frontend-counters ----
+	//
+	// Column headers are plain strings, not label()-wrapped. tabwriter
+	// counts bytes (not rendered width), so wrapping a header cell in
+	// ANSI escape codes inflates its apparent width by ~11 bytes and
+	// the data rows below — which are plain numeric strings — end up
+	// over-padded. The label() convention only works when every cell
+	// in a column shares the same wrapping, which the key-value show
+	// commands do but this table can't (we're not about to colourise
+	// every packet count).
 	fmt.Println(label("frontend-counters"))
-	if len(resp.Vips) == 0 {
-		fmt.Println("  (none)")
-	} else {
-		w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-		fmt.Fprintf(w, "  %s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
-			label("vip"), label("proto"), label("port"),
-			label("first"), label("next"),
-			label("untracked"), label("no-server"),
-			label("fib-packets"), label("fib-bytes"),
-		)
-		for _, v := range resp.Vips {
-			fmt.Fprintf(w, "  %s\t%s\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
-				stripHostMask(v.Prefix), v.Protocol, v.Port,
-				v.FirstPacket, v.NextPacket,
-				v.UntrackedPacket, v.NoServer,
-				v.Packets, v.Bytes,
-			)
-		}
-		if err := w.Flush(); err != nil {
-			return err
-		}
-	}
-
-	fmt.Println()
-
-	// ---- backend-counters ----
-	fmt.Println(label("backend-counters"))
-	if len(resp.Backends) == 0 {
-		fmt.Println("  (none)")
-		return nil
-	}
 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "  %s\t%s\t%s\t%s\n",
-		label("backend"), label("address"),
-		label("fib-packets"), label("fib-bytes"),
-	)
-	for _, b := range resp.Backends {
-		fmt.Fprintf(w, "  %s\t%s\t%d\t%d\n",
-			b.Backend, b.Address, b.Packets, b.Bytes,
+	fmt.Fprintf(w, "  vip\tproto\tport\tfirst\tnext\tuntracked\tno-server\tfib-packets\tfib-bytes\n")
+	for _, v := range resp.Vips {
+		fmt.Fprintf(w, "  %s\t%s\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
+			stripHostMask(v.Prefix), v.Protocol, v.Port,
+			v.FirstPacket, v.NextPacket,
+			v.UntrackedPacket, v.NoServer,
+			v.Packets, v.Bytes,
 		)
 	}
 	return w.Flush()