Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface now
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding (source address on Linux, IP_BOUND_IF on macOS) are build-tagged. Ping
argument construction is a pure, OS-keyed function. NewMonitor now takes a list
of interfaces.

Model: opus-4-8

internal/monitor/ping_test.go

@@ -0,0 +1,48 @@
+package monitor
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestPingArgs(t *testing.T) {
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{"-I", "eth0", "-c1", "-W1", "8.8.8.8"}},
+		{"darwin", []string{"-b", "eth0", "-c1", "-W1000", "8.8.8.8"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			got := pingArgs(tt.goos, "eth0", "8.8.8.8")
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("pingArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLossArgs(t *testing.T) {
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1", "-I", "eth0", "8.8.8.8",
+		}},
+		{"darwin", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1000", "-b", "eth0", "8.8.8.8",
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			got := lossArgs(tt.goos, "eth0", "8.8.8.8", 20)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("lossArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}