Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/monitor/ui.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 import (
@@ -383,9 +381,11 @@ func (m *Monitor) uiLoop(ctx context.Context) {
 		runtime := time.Since(m.startTime).Round(time.Second).String()
 		Put(m.screen, colLeft, rowRuntime, "Runtime: "+runtime, tcell.StyleDefault)
 
+		// Draw one pane per interface; a single interface draws one pane.
 		y := rowFirstIface
-		y = m.DrawInterface(m.screen, y, w, m.interfaceA)
-		_ = m.DrawInterface(m.screen, y, w, m.interfaceB)
+		for _, st := range m.interfaces {
+			y = m.DrawInterface(m.screen, y, w, st)
+		}
 
 		m.screen.Show()
 	}