clear

Drops every binding, so peers is empty until something binds again.

Unlike unbind this is deliberately not identity-scoped: it is for the terminal teardown of the whole session, where no device holds anything any more. A caller that recomputes a roster from peers needs this at tear time — otherwise a post-teardown disconnect callback recomputes from stale bindings and republishes peers that are gone (#1851).