Phase 4: authorised HTTPS interception (Mode B)

Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.

systemd/pilens-proxy.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=PiLens HTTPS interception proxy (mitmdump, authorised Mode B)
+Documentation=file:/opt/pilens/docs/tls-and-encryption.md
+After=network-online.target pilens.service
+Wants=network-online.target
+PartOf=pilens.service
+ConditionPathExists=/var/lib/pilens/proxy/proxy.env
+
+[Service]
+Type=simple
+User=pilens
+Group=pilens
+# Transparent mode reads SO_ORIGINAL_DST on redirected sockets; no extra privilege.
+ExecStart=/opt/pilens/proxy-run.sh
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/lib/pilens/proxy
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=yes
+# started/stopped by the network helper when interception is toggled