Initial commit: wireframe packet capture/analysis tool

Terminal packet capture and analysis tool built to learn the C++
memory model (byte layout, alignment, endianness, std::span over
unowned buffers) via a real capture pipeline.

- Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension
  header walking, TCP, UDP) over std::span, no struct-casting
- L7 dissector interface with DNS, HTTP, and TLS SNI implementations
- pcapng read/write for Wireshark-compatible capture files
- Bounded capture queue: drop-on-backpressure for live capture,
  blocking push for faithful file replay
- Kernel-level BPF filtering (-f) and a separate display-only search
  (-g / interactive) that doesn't touch what's captured
- Replay mode (-r) reads a saved pcapng file back through the same
  pipeline as live capture, no root or live device needed
- pcap_stats() surfaces kernel/interface drops invisible to the
  capture queue's own counter
- Three frontends sharing one CaptureSession setup path: CLI, TUI
  (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary)
- 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every
  hand-rolled parser; fuzzing found and fixed a real OOM in the
  pcapng reader (unbounded allocation from an untrusted length field)

1 files changed, 45 insertions, 0 deletions

diff --git a/include/wireframe/l7/dissector.hpp b/include/wireframe/l7/dissector.hpp
new file mode 100644
index 0000000..9b2cc32
--- /dev/null
+++ b/include/wireframe/l7/dissector.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+// Small interface/vtable for L7 dissectors (PLAN.md's architecture
+// sketch), so protocols can be registered and added incrementally
+// without touching the L2-L4 decode path or main.cpp's dispatch logic.
+namespace wireframe::net {
+
+class L7Dissector {
+public:
+    virtual ~L7Dissector() = default;
+
+    // The transport port this dissector claims (e.g. 53 for DNS). A
+    // single fixed port is enough for the protocols in scope so far;
+    // dissectors needing a port range or heuristic sniffing can widen
+    // this later without changing the registry's shape.
+    virtual std::uint16_t port() const = 0;
+
+    // A one-line summary of the payload, or nullopt if it doesn't look
+    // like this protocol (e.g. truncated/malformed).
+    virtual std::optional<std::string> summarize(std::span<const unsigned char> payload) const = 0;
+};
+
+class L7Registry {
+public:
+    void add(const L7Dissector* dissector) { dissectors_.push_back(dissector); }
+
+    std::optional<std::string> dissect(std::uint16_t port,
+                                        std::span<const unsigned char> payload) const {
+        for (const auto* dissector : dissectors_) {
+            if (dissector->port() == port) return dissector->summarize(payload);
+        }
+        return std::nullopt;
+    }
+
+private:
+    std::vector<const L7Dissector*> dissectors_;
+};
+
+}  // namespace wireframe::net