Make the AllowedIPs refcounter peer-aware: track per-peer refcounts per
prefix and swap WireGuard to a surviving peer when the installed one is
released, instead of leaving the prefix on the removed peer. Fixes routing
peer not updating without netbird down/up when two networks share a prefix.