Phase 2d (0.6.1-beta): route manifest + blob ops through file_holders

Switch ALL propagation-decision reads to the flat holder set.

push_manifest_to_downstream now targets file_holders instead of
blob_downstream. ManifestPush receive-side relay likewise — known
holders fan out to up to 5 most-recent peers instead of a directional
tree.

Blob delete notices: single flat fan-out to file_holders; the legacy
upstream_node tree-healing field is emitted as None (wire-stable via
serde default) and ignored on receive — the post-0.6 flat model
doesn't need sender-role distinction. send_blob_delete_notices keeps
its Option<&Upstream> parameter as an unused placeholder for signature
stability with the call sites in this commit.

Other reads migrated:
- blob fetch cascade: step 2 now tries "known holders" (up to 5)
  instead of a single upstream
- manifest refresh: downstream_count reported from file_holder_count
- web/http post holder enumeration
- Worm search post/blob holder fallback (both connection.rs paths)
- DeleteRecord fan-out rewires to file_holders
- Under-replication replication check: < 2 holders

Storage additions:
- get_file_holder_count(file_id)
- remove_file_holder(file_id, peer_id)

Legacy upstream/downstream writes are still happening from Phase 2b;
those + the tables themselves go in 2e.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/core/src/http.rs

@@ -378,7 +378,11 @@ async fn try_redirect(
             Ok(Some((_, PostVisibility::Public))) => {}
             _ => return false, // not found or not public — hard close
         }
-        store.get_post_downstream(post_id).unwrap_or_default()
+        store.get_file_holders(post_id)
+            .unwrap_or_default()
+            .into_iter()
+            .map(|(nid, _addrs)| nid)
+            .collect::<Vec<_>>()
     };
 
     // Get addresses for downstream peers