Add capture-local packet provenance to PCAP flows

[ShmalexM]

Summary

• emit exact, 1-based first_packet and last_packet capture ordinals for each canonical flow produced from PCAP or PCAPNG
• preserve the ordinals through bidirectional aggregation without retaining packet payloads
• document the provenance contract so downstream protocol observations can be joined to flows deterministically

Why

Canonical flow rows previously had timestamps and five-tuples but no packet-addressable provenance. That made an exact flow-to-protocol-observation association impossible after aggregation. This change provides the minimum deterministic join key while keeping raw PCAP on the processing host.

The output describes observed traffic only; it is not a topology or asset-ownership claim.

Validation

• cargo test — 53 passed
• cargo fmt --all -- --check
• cargo build --release
• release-binary Python E2E suite in Linux — all tests passed, including first_packet / last_packet assertions