maintain

Periodic upkeep: the session-layer port of node::tick and dht_tracker's timers. Call on a steady cadence (libtorrent ticks the refresh timer every 5 s and the storage/token timers on slower multiples; ~30 s is a sensible single cadence here):

1. Self-refresh. When the table is shallow (depth < 4) we run a find_node toward a random id in-range of our own, expanding the buckets nearest us.

2. Stale-bucket refresh. For each bucket we pick a random in-range target and run a short lookup, pulling fresh nodes and exercising the ones we have.

3. Ping questionable nodes. Live nodes with at least one failure are re-pinged; a timeout drives RoutingTable.nodeFailed so they evict/replace.

4. Token + storage ticks. Rotates the write-token secret every TOKEN_ROTATE_SECONDS and ages out the storage every STORAGE_TICK_SECONDS.

5. DoS window reset. Clears the per-source query counters once per window.

All RPC work is best-effort; a dead node simply marks failed.