Phase 4: authorised HTTPS interception (Mode B)

Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.

internal/helper/helper.go

@@ -16,8 +16,10 @@ import (
 const DefaultSocket = "/run/pilens/helper.sock"
 
 type Request struct {
-	Op      string          `json:"op"`
-	Network *config.Network `json:"network,omitempty"`
+	Op               string          `json:"op"`
+	Network          *config.Network `json:"network,omitempty"`
+	InterceptEnabled bool            `json:"intercept_enabled,omitempty"`
+	InterceptPort    int             `json:"intercept_port,omitempty"`
 }
 
 type Response struct {
@@ -32,6 +34,7 @@ const (
 	OpStatus       = "status"
 	OpStations     = "stations"
 	OpLeases       = "leases"
+	OpSetInterception = "set_interception"
 )
 
 type ApplyResult struct {