feat(04-01): add BPF validation, pcap reading, Timestamp field, and filter support

- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go)
- Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF
- Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter
- Update OpenCapture and StartCapture to accept filter string param
- Update cmd/netsynth/main.go to pass empty filter to StartCapture
- All new tests pass; existing tests unaffected

cmd/netsynth/main.go

@@ -65,7 +65,7 @@ func run(cmd *cobra.Command, args []string) error {
 
 	// Stage 1: Capture (CAPT-01)
 	fmt.Fprintf(os.Stderr, "Starting capture on %s... (press Ctrl+C to stop)\n", ifaceName)
-	packets, droppedPtr, err := capture.StartCapture(ctx, ifaceName)
+	packets, droppedPtr, err := capture.StartCapture(ctx, ifaceName, "")
 	if err != nil {
 		return err // CAPT-04: permission error already has platform-specific message
 	}