Add Chains and Capture tabs (v0.2.5)

[ibehren1]

Summary

Two new tabs for fwtop, both on the v0.2.5 branch.

Chains tab (key 4)

A chain-by-chain drill-down of firewall counters. A picker lists every table/chain in the ruleset (with rule count, highlighted red when actively dropping); selecting one shows that chain's rules in ruleset order — position, verdict, live pkt/byte rates, cumulative totals. Reads like nft list chain / iptables -L <chain>, complementing the drops-first Firewall tab.

Capture tab (key 5; Drops moved to 6)

An interactive, opt-in tcpdump. Press f to enter a port/protocol filter; fwtop captures just that traffic and shows three Overview-style stacked panels:

• WAN / LAN throughput charts of the matched flow
• a per-interface breakdown table
• a live packet list in tcpdump's own format (HH:MM:SS.ffffff iface IP src.port > dst.port: …)

s stops capture.

Notes on the Capture design

• First packet-capture source in the app. It shells out to the system tcpdump (one process per interface, matching how firewall.py shells out to nft/iptables) — no new Python dependency.
• Strictly opt-in / low overhead: capture runs only while the tab is on screen; leaving the tab or unmounting stops it, so no tcpdump lingers and the rest of the app keeps its zero-capture footprint.
• Reader daemon threads write to a lock-guarded buffer, drained on the UI timer (the existing Resolver threading model). WAN/LAN classification reuses is_private_ip; interface→zone reuses Config.zone_for.
• Caveat: throughput is derived from captured frame lengths, so it approximates rather than exactly matches the Overview tab's kernel interface counters (documented in the README).

Verification

• Headless Textual pilot tests (demo mode): all six tab keys switch correctly; interactive filter modal parses ports and starts capture; charts, interface table, and packet list all populate; s and leaving the tab both stop capture.
• Unit-tested the tcpdump line parser against representative TCP/UDP/ICMP -e -tt -n output, and the BPF builder.
• All modules compile clean.

⚠️ Not yet exercised against a live tcpdump (developed on macOS, demo-only). Worth a manual Linux/root check before relying on it: sudo fwtop, Capture tab, filter tcp port 443, confirm the panels track real traffic and pgrep tcpdump is empty after leaving the tab.