Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/netdetect/routes_darwin.go

@@ -0,0 +1,27 @@
+//go:build darwin
+
+package netdetect
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"time"
+)
+
+// routeQueryTimeout bounds the external route-table query.
+const routeQueryTimeout = 2 * time.Second
+
+// DefaultRoutes returns the host's IPv4 default routes, read from the macOS
+// routing table.
+func DefaultRoutes() ([]Route, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), routeQueryTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "netstat", "-rn", "-f", "inet").Output()
+	if err != nil {
+		return nil, fmt.Errorf("running netstat: %w", err)
+	}
+
+	return parseNetstat(string(out)), nil
+}