Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/netdetect/routes_linux.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package netdetect
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"time"
+)
+
+// routeQueryTimeout bounds the external route-table query.
+const routeQueryTimeout = 2 * time.Second
+
+// DefaultRoutes returns the host's IPv4 default routes. It prefers the `ip`
+// command and falls back to reading /proc/net/route.
+func DefaultRoutes() ([]Route, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), routeQueryTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx,
+		"ip", "-4", "route", "show", "default").Output()
+	if err == nil {
+		if routes := parseIPRoute(string(out)); len(routes) > 0 {
+			return routes, nil
+		}
+	}
+
+	data, err := os.ReadFile("/proc/net/route")
+	if err != nil {
+		return nil, fmt.Errorf("reading /proc/net/route: %w", err)
+	}
+
+	return parseProcNetRoute(string(data)), nil
+}