Phase 4: authorised HTTPS interception (Mode B)

Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.

scripts/uninstall.sh

@@ -15,7 +15,7 @@ if [ $PURGE = 1 ]; then
   [ "$x" = DELETE ] || { echo "not confirmed; keeping data"; PURGE=0; }
 fi
 
-systemctl disable --now pilens pilens-dnsmasq pilens-helper pilens-firewall 2>/dev/null || true
+systemctl disable --now pilens pilens-proxy pilens-dnsmasq pilens-helper pilens-firewall 2>/dev/null || true
 nmcli connection delete pilens-ap 2>/dev/null && echo "removed access-point profile (other Wi-Fi profiles were never modified and will reconnect)" || true
 rm -f /etc/NetworkManager/system-connections/pilens-ap.nmconnection
 nft delete table inet pilens 2>/dev/null && echo "removed firewall table inet pilens" || true