Add Starlink status lines for the physical gateway pane (closes #3)

When the non-VPN physical gateway is a Starlink dish, two lines are shown
under that pane: state, uptime, obstruction and alert count; then pop-ping
latency and drop rate with downlink/uplink throughput. They turn red when
the dish is not connected or an alert is active.

Detection is a TCP connect to the dish's fixed endpoint 192.168.100.1:9200,
bound to the physical interface the same way the latency probes bind. Until
a dish answers nothing is drawn and no status is fetched, so an absent dish
adds no noise. Status comes from the dish's local get_status gRPC call.

Detection and the fetch sit behind a small Client interface; the loop and
the pure Render function are tested with a fake, no dish and no network.

Model: opus-4-8

internal/starlink/pb/starlink_grpc.pb.go

@@ -0,0 +1,140 @@
+// A minimal slice of the Starlink dish's local gRPC API: just the one
+// unary RPC (SpaceX.API.Device.Device/Handle) and the get_status request
+// and dish status response, reduced to the handful of fields rtnetmon
+// shows. The proto package name and field numbers must match the dish
+// exactly for the wire format to line up; every other field the dish sends
+// is ignored as an unknown field.
+//
+// Field numbers, message names and the DishState enum are transcribed from
+// the community-maintained pre-generated bindings at
+// github.com/starlink-community/starlink-grpc-go, commit
+// 2e89f3d7e3092adecbcc04e9e003e61ed5f7c6a3 (get_status = 1004,
+// dish_get_status = 2004). They are not verified against a live dish here.
+//
+// Regenerate with:
+//   protoc --go_out=. --go_opt=paths=source_relative \
+//          --go-grpc_out=. --go-grpc_opt=paths=source_relative \
+//          internal/starlink/pb/starlink.proto
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v7.36.2
+// source: internal/starlink/pb/starlink.proto
+
+package starlinkpb
+
+import (
+	context "context"
+
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Device_Handle_FullMethodName = "/SpaceX.API.Device.Device/Handle"
+)
+
+// DeviceClient is the client API for Device service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type DeviceClient interface {
+	Handle(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
+}
+
+type deviceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewDeviceClient(cc grpc.ClientConnInterface) DeviceClient {
+	return &deviceClient{cc}
+}
+
+func (c *deviceClient) Handle(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Response)
+	err := c.cc.Invoke(ctx, Device_Handle_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// DeviceServer is the server API for Device service.
+// All implementations must embed UnimplementedDeviceServer
+// for forward compatibility.
+type DeviceServer interface {
+	Handle(context.Context, *Request) (*Response, error)
+	mustEmbedUnimplementedDeviceServer()
+}
+
+// UnimplementedDeviceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDeviceServer struct{}
+
+func (UnimplementedDeviceServer) Handle(context.Context, *Request) (*Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Handle not implemented")
+}
+func (UnimplementedDeviceServer) mustEmbedUnimplementedDeviceServer() {}
+func (UnimplementedDeviceServer) testEmbeddedByValue()                {}
+
+// UnsafeDeviceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DeviceServer will
+// result in compilation errors.
+type UnsafeDeviceServer interface {
+	mustEmbedUnimplementedDeviceServer()
+}
+
+func RegisterDeviceServer(s grpc.ServiceRegistrar, srv DeviceServer) {
+	// If the following call pancis, it indicates UnimplementedDeviceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Device_ServiceDesc, srv)
+}
+
+func _Device_Handle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DeviceServer).Handle(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Device_Handle_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DeviceServer).Handle(ctx, req.(*Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Device_ServiceDesc is the grpc.ServiceDesc for Device service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Device_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "SpaceX.API.Device.Device",
+	HandlerType: (*DeviceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Handle",
+			Handler:    _Device_Handle_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "internal/starlink/pb/starlink.proto",
+}