feat(04-01): add BPF validation, pcap reading, Timestamp field, and filter support

- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go)
- Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF
- Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter
- Update OpenCapture and StartCapture to accept filter string param
- Update cmd/netsynth/main.go to pass empty filter to StartCapture
- All new tests pass; existing tests unaffected

capture/bpf_test.go

@@ -0,0 +1,56 @@
+package capture
+
+import (
+	"testing"
+)
+
+// TestValidateBPFFilter verifies that a valid BPF expression returns nil error.
+func TestValidateBPFFilter(t *testing.T) {
+	if err := ValidateBPFFilter("port 53"); err != nil {
+		t.Errorf("ValidateBPFFilter(\"port 53\") = %v; want nil", err)
+	}
+}
+
+// TestValidateBPFFilterEmpty verifies that empty string returns nil (no filter).
+func TestValidateBPFFilterEmpty(t *testing.T) {
+	if err := ValidateBPFFilter(""); err != nil {
+		t.Errorf("ValidateBPFFilter(\"\") = %v; want nil", err)
+	}
+}
+
+// TestValidateBPFFilterWhitespace verifies that whitespace-only string returns nil.
+func TestValidateBPFFilterWhitespace(t *testing.T) {
+	if err := ValidateBPFFilter("   "); err != nil {
+		t.Errorf("ValidateBPFFilter(\"   \") = %v; want nil", err)
+	}
+}
+
+// TestValidateBPFFilterInvalid verifies that invalid BPF expression returns error.
+func TestValidateBPFFilterInvalid(t *testing.T) {
+	err := ValidateBPFFilter("invalid garbage xyz")
+	if err == nil {
+		t.Error("ValidateBPFFilter(\"invalid garbage xyz\") = nil; want non-nil error")
+	}
+}
+
+// TestCompileSoftwareBPF verifies that a valid expression compiles to a non-nil VM.
+func TestCompileSoftwareBPF(t *testing.T) {
+	vm, err := CompileSoftwareBPF("tcp")
+	if err != nil {
+		t.Errorf("CompileSoftwareBPF(\"tcp\") error: %v", err)
+	}
+	if vm == nil {
+		t.Error("CompileSoftwareBPF(\"tcp\") returned nil VM; want non-nil")
+	}
+}
+
+// TestCompileSoftwareBPFInvalid verifies that invalid expression returns nil VM and non-nil error.
+func TestCompileSoftwareBPFInvalid(t *testing.T) {
+	vm, err := CompileSoftwareBPF("invalid garbage")
+	if err == nil {
+		t.Error("CompileSoftwareBPF(\"invalid garbage\") error = nil; want non-nil")
+	}
+	if vm != nil {
+		t.Error("CompileSoftwareBPF(\"invalid garbage\") VM non-nil; want nil")
+	}
+}