Add FTP, SMTP, TFTP, and IGMP; fix an IGMPv3 group-address misparse

FTP and SMTP share HTTP's line-based response-code-or-command shape
but keep their own command vocabularies in separate files rather than
sharing a parser. FTP passwords are shown as-is, not redacted - FTP
sends them in the clear regardless, matching Wireshark's own behavior.
TFTP is a small binary opcode protocol (RFC 1350) instead. IGMP sits
directly on IP like ICMP, so it's dispatched by protocol number rather
than through the port-keyed L7Registry the other three use.

Live-verified: FTP/SMTP against minimal real TCP servers written for
this (nothing installed locally), a full command/response exchange
decoded correctly in both directions. TFTP against a real atftpd
server and atftp client - the RRQ decoded correctly even though the
transfer itself didn't complete (an atftpd sandbox issue, not this
code). IGMP against real multicast traffic on wlp1s0, including a
genuine query from the actual router.

That live IGMP traffic caught a real bug before it shipped further:
parse_igmp() read bytes[4:8] as a group address for every message
type, but IGMPv3 reports use those bytes for Reserved+RecordCount
instead - a real V3 report showed "group=0.0.0.1" (0 reserved, 1
record, misread as an IP). Fixed by only populating group for the
types where it's genuinely an address; re-verified against the same
live traffic, and a regression test locks in the exact pattern.

1 files changed, 39 insertions, 0 deletions

diff --git a/PLAN.md b/PLAN.md
index a9a8da6..3fa8c1d 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -461,3 +461,42 @@ None currently open.
   correctly unwrapped. Both virtual interfaces and the dummy/8021q
   kernel modules they pulled in were torn down afterward, restoring
   the machine to its prior state.
+- FTP (l7/ftp.hpp), SMTP (l7/smtp.hpp), TFTP (l7/tftp.hpp), and IGMP
+  (net/igmp.hpp), pushing further toward broad real-world coverage.
+  FTP's control channel and SMTP share the same line-based
+  response-code-or-command shape as HTTP (SMTP's own RFC predates and
+  clearly borrowed from FTP's), but were kept as separate files with
+  their own command vocabularies rather than sharing a parser - the
+  overlap is real but shallower than DNS/mDNS's identical wire format,
+  not worth coupling two otherwise-independent protocols over. FTP
+  passwords (PASS) are shown as-is, not redacted: FTP sends them in the
+  clear regardless, so this reflects what's genuinely on the wire, the
+  same reasoning Wireshark itself uses. TFTP is a small binary
+  protocol instead (opcode + a shape that depends on it), decoded via
+  RFC 1350; OACK is recognized by opcode but its options aren't parsed.
+  IGMP sits directly on IP (protocol 2) like ICMP, so it's dispatched
+  by protocol number in summarize_transport_and_above() rather than
+  through the port-keyed L7Registry the other four use.
+  Live-verified: FTP and SMTP against minimal real TCP servers written
+  for this (no vsftpd/postfix installed on this machine) speaking
+  genuine line protocol over real loopback TCP segments - both
+  directions of a full USER/PASS/QUIT and EHLO/MAIL/RCPT/QUIT exchange
+  decoded correctly. TFTP against a real atftpd server and atftp
+  client - the client's actual RRQ packet decoded as "TFTP RRQ
+  testfile.txt (octet)" (the transfer itself didn't complete, an
+  atftpd sandbox/config issue unrelated to the dissector, but the
+  request itself is what needed verifying). IGMP against real
+  multicast traffic on wlp1s0: joining 239.255.255.250 from Python
+  produced genuine IGMPv3 Membership Reports, and a real
+  group-specific query later arrived from the actual router
+  (192.168.1.1) - "IGMP Membership Query group=239.255.255.250".
+  That same live traffic caught a real bug before it shipped further:
+  the first parse_igmp() read bytes[4:8] as a group address for every
+  message type, but IGMPv3 reports put Reserved+RecordCount there
+  instead - a real V3 report showed "group=0.0.0.1" (literally
+  "0 reserved, 1 group record" misread as an IP). Fixed by only
+  populating IgmpMessage::group (now optional) for the types where
+  those bytes genuinely are an address (query/v1/v2 report/leave);
+  re-verified against the same live traffic afterward, confirmed
+  clean, and a regression test locks in the exact byte pattern that
+  triggered it.