Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/monitor/export_test.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 // Test-only accessors exposing unexported state for white-box assertions.
@@ -13,8 +11,13 @@ func (m *Monitor) PacketLossHosts() []string { return m.packetLossHosts }
 // TCPHosts returns the configured TCP hosts.
 func (m *Monitor) TCPHosts() []string { return m.tcpHosts }
 
-// InterfaceA returns the first monitored interface.
-func (m *Monitor) InterfaceA() *InterfaceStatus { return m.interfaceA }
+// Interfaces returns the monitored interfaces.
+func (m *Monitor) Interfaces() []*InterfaceStatus { return m.interfaces }
 
-// InterfaceB returns the second monitored interface.
-func (m *Monitor) InterfaceB() *InterfaceStatus { return m.interfaceB }
+// PingArgs exposes pingArgs for external tests.
+func PingArgs(goos, iface, host string) []string { return pingArgs(goos, iface, host) }
+
+// LossArgs exposes lossArgs for external tests.
+func LossArgs(goos, iface, host string, count int) []string {
+	return lossArgs(goos, iface, host, count)
+}