Core packages: config validation, network renderers, root helper, auth, SQLite store, capture engine

Capture engine streams dumpcap pcapng into verbatim, hashed segments with
per-segment tshark summaries; display filters, PDML dissection with verified
byte ranges, export and import. Tests run in a Debian trixie container.

migrations/001_init.sql

@@ -0,0 +1,112 @@
+CREATE TABLE settings (
+	key TEXT PRIMARY KEY,
+	value TEXT NOT NULL,
+	updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE users (
+	id INTEGER PRIMARY KEY,
+	username TEXT NOT NULL UNIQUE,
+	password_hash TEXT NOT NULL,
+	totp_secret TEXT NOT NULL DEFAULT '',
+	totp_enabled INTEGER NOT NULL DEFAULT 0,
+	created_at INTEGER NOT NULL
+);
+
+CREATE TABLE sessions (
+	token_hash TEXT PRIMARY KEY,
+	user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	csrf TEXT NOT NULL,
+	created_at INTEGER NOT NULL,
+	last_seen INTEGER NOT NULL,
+	expires_at INTEGER NOT NULL,
+	remote TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE audit (
+	id INTEGER PRIMARY KEY,
+	ts INTEGER NOT NULL,
+	actor TEXT NOT NULL,
+	action TEXT NOT NULL,
+	detail TEXT NOT NULL DEFAULT '',
+	remote TEXT NOT NULL DEFAULT ''
+);
+CREATE INDEX audit_ts ON audit(ts);
+
+-- A device is keyed by observed MAC address. Randomised MACs mean a physical
+-- device may appear as several rows; nothing here merges them automatically.
+CREATE TABLE devices (
+	mac TEXT PRIMARY KEY,
+	label TEXT NOT NULL DEFAULT '',
+	notes TEXT NOT NULL DEFAULT '',
+	hostname TEXT NOT NULL DEFAULT '',
+	last_ip TEXT NOT NULL DEFAULT '',
+	first_seen INTEGER NOT NULL,
+	last_seen INTEGER NOT NULL
+);
+
+CREATE TABLE capture_sessions (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL,
+	description TEXT NOT NULL DEFAULT '',
+	kind TEXT NOT NULL,              -- live | import
+	state TEXT NOT NULL,             -- running | stopped | failed | ready
+	interfaces TEXT NOT NULL DEFAULT '[]',
+	capture_filter TEXT NOT NULL DEFAULT '',
+	started_at INTEGER NOT NULL,     -- unix ms UTC
+	ended_at INTEGER NOT NULL DEFAULT 0,
+	packets INTEGER NOT NULL DEFAULT 0,
+	bytes INTEGER NOT NULL DEFAULT 0,
+	drops TEXT NOT NULL DEFAULT '',  -- capture-engine drop report, verbatim
+	error TEXT NOT NULL DEFAULT '',
+	preserved INTEGER NOT NULL DEFAULT 0,
+	tags TEXT NOT NULL DEFAULT '',
+	notes TEXT NOT NULL DEFAULT '',
+	dir TEXT NOT NULL,
+	meta TEXT NOT NULL DEFAULT '{}', -- versions, clock sync, parameters
+	ring_segments INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE segments (
+	session_id TEXT NOT NULL REFERENCES capture_sessions(id) ON DELETE CASCADE,
+	seq INTEGER NOT NULL,
+	file TEXT NOT NULL,
+	format TEXT NOT NULL,            -- pcapng | pcap
+	base INTEGER NOT NULL,           -- global number of the first packet
+	count INTEGER NOT NULL DEFAULT 0,
+	bytes INTEGER NOT NULL DEFAULT 0,
+	sha256 TEXT NOT NULL DEFAULT '',
+	complete INTEGER NOT NULL DEFAULT 0,
+	deleted INTEGER NOT NULL DEFAULT 0,
+	PRIMARY KEY (session_id, seq)
+);
+
+-- One summary row per packet. Full dissection is produced on demand by tshark.
+CREATE TABLE packets (
+	session_id TEXT NOT NULL,
+	num INTEGER NOT NULL,
+	seg INTEGER NOT NULL,
+	off INTEGER NOT NULL,
+	ts REAL NOT NULL,
+	src TEXT NOT NULL,
+	dst TEXT NOT NULL,
+	proto TEXT NOT NULL,
+	len INTEGER NOT NULL,
+	info TEXT NOT NULL,
+	sport INTEGER,
+	dport INTEGER,
+	stream INTEGER,
+	tcpflags TEXT,
+	ttl INTEGER,
+	vlan INTEGER,
+	color TEXT,
+	PRIMARY KEY (session_id, num)
+) WITHOUT ROWID;
+
+CREATE TABLE saved_filters (
+	id INTEGER PRIMARY KEY,
+	name TEXT NOT NULL,
+	kind TEXT NOT NULL,              -- display | capture
+	expr TEXT NOT NULL,
+	created_at INTEGER NOT NULL
+);

migrations/embed.go

@@ -0,0 +1,7 @@
+// Package migrations embeds the ordered SQL schema migrations.
+package migrations
+
+import "embed"
+
+//go:embed *.sql
+var FS embed.FS