- Add classify/rules.go: Rule struct and DefaultRules slice with 12 rules (10 specific protocol rules + 2 catch-alls for other-TCP/other-UDP) - Add classify/classifier.go: Classifier with NewClassifier and Classify methods - Config-driven slice (not switch) per D-02; first-match-wins ordering - Returns ClassUnknown for non-TCP/UDP/ICMP traffic per D-03 - All 14 tests pass covering all 11 traffic classes