Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/monitor/ping_test.go

@@ -0,0 +1,58 @@
+package monitor_test
+
+import (
+	"reflect"
+	"testing"
+
+	"git.eeqj.de/sneak/rtnetmon/internal/monitor"
+)
+
+func TestPingArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{"-I", ifaceEth0, "-c1", "-W1", host8888}},
+		{"darwin", []string{"-b", ifaceEth0, "-c1", "-W1000", host8888}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			t.Parallel()
+
+			got := monitor.PingArgs(tt.goos, ifaceEth0, host8888)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("PingArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLossArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1", "-I", ifaceEth0, host8888,
+		}},
+		{"darwin", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1000", "-b", ifaceEth0, host8888,
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			t.Parallel()
+
+			got := monitor.LossArgs(tt.goos, ifaceEth0, host8888, 20)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("LossArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}