Phase 4: authorised HTTPS interception (Mode B)

Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.

Makefile

@@ -19,7 +19,7 @@ build: web
 	$(GO) build -trimpath -ldflags '$(LDFLAGS)' -o dist/$(PKG)/bin/pilens-helper ./cmd/pilens-helper
 
 package: build
-	cp -r systemd packaging/setup.example.yaml dist/$(PKG)/
+	cp -r systemd packaging/setup.example.yaml packaging/mitm_addon.py dist/$(PKG)/
 	cp scripts/*.sh dist/$(PKG)/
 	cp -r docs README.md LICENSE dist/$(PKG)/
 	echo $(VERSION) > dist/$(PKG)/VERSION