Add privilege dropping, AF_PACKET demo, ICMP, checksum validation, --help, and TCP reassembly

Rounds out the build order in PLAN.md with six incremental additions:
drop root privileges immediately after opening the capture handle;
a standalone AF_PACKET/mmap ring-buffer demo (kept separate from
CaptureSession, see its header comment for why); ICMPv4/ICMPv6 type
and code decoding; opt-in IPv4/TCP/UDP checksum validation (-c);
CLI --help; and opt-in, in-order-only TCP stream reassembly (-a) so
HTTP requests/responses split across segments can be seen whole.
Each addition is unit-tested and, where it touches live traffic
behavior, verified against real captured packets - see PLAN.md's
Decisions section for the verification notes on each.

1 files changed, 14 insertions, 0 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 211738a..abe3546 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -32,6 +32,16 @@ target_link_libraries(wireframe PRIVATE
   ftxui::screen
 )
 
+# Standalone AF_PACKET/mmap ring buffer demo (see the file's own header
+# comment for why this is separate from CaptureSession). AF_PACKET is a
+# Linux-specific socket family, unlike the portable libpcap path the
+# rest of this project uses - only built on Linux.
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  add_executable(wireframe_afpacket_demo src/afpacket_capture.cpp)
+  target_include_directories(wireframe_afpacket_demo PRIVATE include)
+  target_link_libraries(wireframe_afpacket_demo PRIVATE pcap)
+endif()
+
 # GUI (secondary to the TUI - see PLAN.md Decisions). Dear ImGui +
 # SDL3, same FetchContent approach as FTXUI/doctest: no dependency on
 # a system package, so it builds the same way on every platform this
@@ -97,6 +107,10 @@ add_executable(wireframe_tests
   tests/test_summarize.cpp
   tests/test_capture_session.cpp
   tests/test_search.cpp
+  tests/test_privileges.cpp
+  tests/test_icmp.cpp
+  tests/test_checksum.cpp
+  tests/test_tcp_reassembly.cpp
 )
 target_include_directories(wireframe_tests PRIVATE include)
 target_link_libraries(wireframe_tests PRIVATE doctest::doctest Threads::Threads pcap)