fix(replication): carry failure rolling windows through cluster aggregation

Review: both metrics endpoints aggregate first, and FailStats::merge
dropped the process-local samples (which also never cross the peer-RPC
wire — serde-skipped), so lastMinute/lastHour serialized as zero right
after a failure while totals was nonzero.

- FailStats gains serializable last_minute/last_hour window snapshots
  (serde default: old nodes read zeros, new fields are ignored by old
  decoders), recomputed on every add_size and re-stamped at the
  per-node collection point (get_latest_replication_stats), and summed
  by merge.
- The wire DTO takes the component-wise max of the live samples and the
  snapshot, so both the single-node and the aggregated path report the
  window.
- Regression test drives a stat through rmp round trip + merge before
  serialization, as requested.

Also restore the #[allow(dead_code)] attribute to route_policy — the
new module declaration had been inserted between the attribute and its
item, which broke the -D warnings CI lanes.

crates/replication/src/stats.rs

@@ -520,6 +520,14 @@ struct FailureSample {
 pub struct FailStats {
     pub count: i64,
     pub size: i64,
+    /// Rolling-window snapshots refreshed at collection time
+    /// ([`Self::refresh_windows`]). The raw samples (`recent`) are process
+    /// local (serde-skipped), so these fields are what survives the peer-RPC
+    /// wire and [`Self::merge`]-based cluster aggregation.
+    #[serde(default)]
+    pub last_minute: FailedMetric,
+    #[serde(default)]
+    pub last_hour: FailedMetric,
     #[serde(skip)]
     recent: VecDeque<FailureSample>,
 }
@@ -535,6 +543,16 @@ impl FailStats {
         self.size = self.size.saturating_add(size);
         self.recent.push_back(FailureSample { observed_at, size });
         self.prune(observed_at);
+        self.refresh_windows();
+    }
+
+    /// Recompute the serializable rolling-window snapshots from the local
+    /// samples. Only meaningful on the live per-node struct: a deserialized
+    /// or merged struct has no samples, and refreshing it would wipe the
+    /// aggregated windows.
+    pub fn refresh_windows(&mut self) {
+        self.last_minute = self.recent_since(Duration::from_secs(60));
+        self.last_hour = self.recent_since(Duration::from_secs(3600));
     }
 
     fn prune(&mut self, observed_at: Instant) {
@@ -565,6 +583,16 @@ impl FailStats {
         Self {
             count: self.count.saturating_add(other.count),
             size: self.size.saturating_add(other.size),
+            // The window snapshots sum across nodes; the raw samples do not
+            // travel and stay empty on aggregated structs.
+            last_minute: FailedMetric {
+                count: self.last_minute.count.saturating_add(other.last_minute.count),
+                size: self.last_minute.size.saturating_add(other.last_minute.size),
+            },
+            last_hour: FailedMetric {
+                count: self.last_hour.count.saturating_add(other.last_hour.count),
+                size: self.last_hour.size.saturating_add(other.last_hour.size),
+            },
             recent: VecDeque::new(),
         }
     }