feat(core): "Internet only", the mirror of LAN mode, plus GUI fixes

[donislawdev]

Three things that were asked for, plus two defects the work uncovered on the way.

"Internet only" - the mirror of LAN mode

A second checkbox under "Traffic to modify", and --internet-only on the command line: it
cuts the local network and leaves the internet up, for testing an application whose intranet
server, NAS or printer has gone away. Pipeline step 2b, reason internet_only, counter
drop_internet_only. The numbered pipeline 1..12 is unchanged.

Loopback survives it. utils.is_lan_ip is deliberately not the mirror of is_local_ip:
a machine talking to itself is not "the local network", and cutting 127.x would take down a
local development server on the very machine running the tool. Both the tooltip and the
READMEs say so, together with the half nobody expects - the router is on the local network,
so DNS asked of it stops with everything else and the internet then looks broken.

Measured while writing the predicate, because it reads the other way round: IPv4 multicast is
globally routable as far as ipaddress is concerned, so mDNS and SSDP sit on the internet
side of both switches.

Both switches on at once is allowed and said out loud in the log. They judge the same packet
from opposite sides and can never both fire on it, so each counter reports its own half and
only loopback gets through. Refusing the combination was rejected: it is the union of two
impairments, like --loss 100.

Two constraints that shaped the change:

• The flag may not start with lan-. Measured: a second --lan-* option makes the --lan
  abbreviation ambiguous and argparse then refuses it outright, silently breaking a documented
  shortcut of --lan-mode.
• decide() sat exactly on the complexity ceiling. The two gates went behind one statement
  calling _address_class_cut, guarded so an ordinary session still pays two attribute reads
  and no call. Measured: the metric counts branch statements and not the boolean operators
  inside them, so the obvious nested pair reads as 30 while this reads as 29. The ceiling was
  not raised.

A switch to hide the Control page's search box

Settings -> Display, on by default. It applies immediately rather than on the next tick: a
widget that appears or disappears up to 0.7 s after the click reads as a broken checkbox.

Hiding clears. The marks are painted on the form, so a standing query would leave fields
highlighted with no box left to clear them from, the sections the search unfolded would stay
unfolded, and a debounce in flight would repaint both after the bar was gone. Bringing the bar
back names what to sit before, because pack hands out space in call order. Ctrl+F declines
when the box is hidden and falls back to the connection table, instead of focusing an unmapped
widget and swallowing the keystrokes that follow the shortcut.

The Statistics copy menu was white

ttk styles do not reach a classic menu - on Windows it is a native popup - and the connection
table wrapped its menu in the dark theme while this one did not, two files apart. Nothing in
the suite could see it: the fake tkinter records colours and never renders them. Two guards,
because "the wrapper is called" and "the menu is dark" are two claims, and the first one walks
the AST so the next menu somebody adds cannot repeat this.

Two defects found on the way, not asked for

• A reproduction command left out --narrow-filter. Found by running the CLI and reading
  its own Reproduce: line, not by a test - the suite was green. settings_to_cli is a
  hand-written list that had fallen behind the registry by two flags, so a session started
  with a narrowed capture produced a command that re-runs a wider one: the packet counts of
  the re-run cannot match the report they came from. The reproduction report carried the fact
  faithfully all along, which is why nobody noticed. New guard walks the field registry and
  demands each flag appear in the command.
• Pref.hint was dead text for checkbox rows. The Settings window returns before the hint
  is drawn for anything but a numeric row, so a 250-character explanation on "Show only the
  targeted traffic" was written, translated into both languages and shown to nobody. The field
  registry has had a guard for exactly this since a field did the same thing; the preference
  registry now has its mirror. Nothing was lost by deleting the key - checked line by line, the
  tooltip already carried everything it said.

Contracts

NDJSON, the CSV export and the reproduction report all gained a key. Additive, so this is not
a breaking change and the version is untouched.

Verification

The full suite runs here, on both platforms. Locally: the guards of everything touched (501
of them), ruff, mypy and the GUI smoke, plus nine entries added to the mutation registry,
all caught.

Beyond the suite, because it is the part the suite cannot reach:

• the live GUI at 150% DPI in Polish - the new checkbox beside its sibling, the summary line,
  the new counter cell, the search box disappearing and coming back in its own place, and
  Ctrl+F falling through to the connections table;
• the CLI end to end - the counter moving, the both-switches line in the log, the reproduction
  command carrying both flags, and the same command run twice;
• a config file written by an older version, which has no such setting, still loading;
• a rig against the real driver: three channels - a LAN peer, a public resolver and a
  loopback echo it owns - through four phases, twice, with the drop counts repeating exactly.
  It was then shown able to fail: with the loopback carve-out mutated out, it exits non-zero
  and names exactly the two phases whose loopback column broke.