Frontend flush-on-down policy; v0.9.3

Adds a per-frontend flush-on-down flag (default true) that causes
maglevd to set is_flush=true on lb_as_set_weight when a backend
transitions to StateDown, tearing down existing flows pinned to
the dead AS instead of just draining them. rise/fall debouncing
in the health checker already absorbs single-probe flaps, so a
fall-counted down is almost always a real outage — and during a
real outage the client-visible "connection refused" oscillation
window (where VPP keeps steering existing flows at a dead AS
until retry) is a reliability regression worth closing by default.
Operators who want the pre-flag drain-only behaviour can set
flush-on-down: false per frontend.

BackendEffectiveWeight's truth table grows one axis: StateDown
now returns (0, flushOnDown); StateDisabled still unconditionally
flushes; StateUnknown / StatePaused still never flush. The unit
test pins all four combinations.

The flag surfaces in the gRPC FrontendInfo message and in
`maglevc show frontend <name>` right next to src-ip-sticky.

internal/config/config.go

@@ -121,6 +121,15 @@ type Frontend struct {
 	Port        uint16 // 0 means omitted (all ports)
 	Pools       []Pool // ordered tiers; first pool with any up backend is active
 	SrcIPSticky bool   // when true, VPP LB uses src-IP-based hashing for this VIP
+	// FlushOnDown: when true (default), a backend transition to
+	// StateDown causes maglevd to set is_flush=true on the VPP
+	// weight update so existing flows pinned to the dead AS are
+	// torn down immediately. With it false, down transitions only
+	// drain (weight=0, keep flows), matching the pre-flag
+	// behaviour. rise/fall debouncing already protects against
+	// single-probe flaps, so defaulting to flush=true is safe for
+	// the common case of a real outage.
+	FlushOnDown bool
 }
 
 // ---- raw YAML types --------------------------------------------------------
@@ -202,6 +211,7 @@ type rawFrontend struct {
 	Port        uint16    `yaml:"port"`
 	Pools       []rawPool `yaml:"pools"`
 	SrcIPSticky bool      `yaml:"src-ip-sticky"`
+	FlushOnDown *bool     `yaml:"flush-on-down"` // nil → default true
 }
 
 // ---- Check / Load ----------------------------------------------------------
@@ -538,6 +548,7 @@ func convertFrontend(name string, r *rawFrontend, backends map[string]Backend) (
 		Protocol:    r.Protocol,
 		Port:        r.Port,
 		SrcIPSticky: r.SrcIPSticky,
+		FlushOnDown: boolDefault(r.FlushOnDown, true),
 	}
 
 	ip := net.ParseIP(r.Address)