Phase 4: authorised HTTPS interception (Mode B)

Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.

internal/api/server.go

@@ -21,6 +21,7 @@ import (
 	"pilens.dev/pilens/internal/capture"
 	"pilens.dev/pilens/internal/config"
 	"pilens.dev/pilens/internal/helper"
+	"pilens.dev/pilens/internal/proxy"
 	"pilens.dev/pilens/internal/store"
 )
 
@@ -39,6 +40,7 @@ type Server struct {
 	Engine         *capture.Engine
 	Helper         helper.Client
 	Version        string
+	Proxy          *proxy.Manager
 	Web            fs.FS // built UI; may be nil in tests
 	SetupTokenPath string
 	DataDir        string
@@ -82,6 +84,7 @@ func (s *Server) Handler() http.Handler {
 	s.networkRoutes(priv)
 	s.captureRoutes(priv)
 	s.analysisRoutes(priv)
+	s.interceptionRoutes(priv)
 
 	if s.Web != nil {
 		files := http.FileServerFS(s.Web)