feat(04-01): add BPF validation, pcap reading, Timestamp field, and filter support

- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go)
- Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF
- Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter
- Update OpenCapture and StartCapture to accept filter string param
- Update cmd/netsynth/main.go to pass empty filter to StartCapture
- All new tests pass; existing tests unaffected

classify/types.go

@@ -1,5 +1,7 @@
 package classify
 
+import "time"
+
 // TrafficClass represents a classified network traffic category.
 type TrafficClass string
 
@@ -32,11 +34,12 @@ func AllClasses() []TrafficClass {
 
 // ClassifiedPacket pairs a raw packet's classification result with metadata.
 type ClassifiedPacket struct {
-	Class    TrafficClass
-	SrcPort  uint16
-	DstPort  uint16
-	Protocol string // "tcp", "udp", "icmp"
-	Length   int
+	Class     TrafficClass
+	SrcPort   uint16
+	DstPort   uint16
+	Protocol  string    // "tcp", "udp", "icmp"
+	Length    int
+	Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
 }
 
 // WindowSnapshot holds aggregated packet counts for a time window.