Fix WPA/RSN detection in the WiFi bridge, and add the missing pkt_sniff.py

[willryker]

Fix WPA/RSN detection in the WiFi bridge, and add the missing pkt_sniff.py

Two independent fixes plus one new file, all in the Linux host-radio bridge path
(wdg_wifi_bridge.py). Tested on a uConsole (CM5, Debian trixie) driving a
MediaTek MT7921AU adapter in place of an ESP32.

1. _auth_from_iw() reports almost every network as OPEN

iw scan never prints the literal strings WPA2 or WPA3. It reports modern
security as an RSN: information element, and _auth_from_iw() only matched
the literal version strings — so every WPA2/WPA3 network fell through to OPEN.

On a live scan here that was 31 of 37 access points misclassified.

This is not cosmetic. The value feeds loot_manager._AUTH_MAP and is uploaded to
WiGLE, so any bridge user wardriving is publishing secured networks as open
and quietly polluting a public dataset.

The fix maps RSN → WPA2, RSN+SAE → WPA3, RSN+PSK+SAE →
WPA2/WPA3, and RSN+WPA → WPA/WPA2. scan_wifi() now also collects
Authentication suites lines, because the AKM suite is the only way to tell WPA3
from WPA2. Only tokens loot_manager._AUTH_MAP already knows are emitted.

Verified after the change: an eero mesh reads WPA2/WPA3, a Spectrum gateway
reads WPA2, and a genuinely open speaker setup AP still reads OPEN.

2. pkt_sniff.py did not exist

_start_pkt() dispatches pkt_sniff.py on start_sniffer / start_pkt_sniff,
but the file is not in the repo, so the Pkt Sniffer menu item has always failed
with sniffer error: pkt_sniff.py not found.

This adds it, matching hs_capture.py's conventions and the contract the bridge
already expects (--iface, --loot-dir, streamed stdout, SIGTERM shutdown):

• scapy monitor-mode sniffer with 2.4/5 GHz channel hopping, dropping channels
  the regulatory domain rejects rather than retrying them every pass
• live [SNF] AP / [SNF] STA / [SNF] DEAUTH lines, periodic summaries in the
  "<ssid>, CH<n>: <count>" shape network_manager.parse_sniffer_results()
  documents, and pcap + text output into the loot directory
• print(..., flush=True) throughout — the bridge reads stdout as a pipe, so
  block buffering would leave the game with no output until the process exits
• filters group (multicast) addresses by the I/G bit. Without this, every
  mDNS/SSDP frame an AP forwards is counted as an associated station and the
  per-AP client counts are meaningless
• ranks the summary by client count before packet count, so the AP clients are
  actually associated to is not crowded out by beacon-heavy neighbours

3. Handshake capture and the packet sniffer can destroy each other

hs_capture.py and pkt_sniff.py both take the --sniffer-iface radio. Run
together they fight over channel hopping, and whichever exits first drops the
interface back to managed mode, killing the other mid-capture. This is guaranteed
to bite on a single-adapter setup, where --iface and --sniffer-iface are the
same device.

The bridge now refuses to start either while the other is active, and
pkt_sniff.py only restores managed mode if it was the one that set monitor.

Note the refusal strings deliberately read "hs capture" / "pkt sniffer": emitting
handshake ... captur or packet sniffer would trip app.py's
_handle_serial_line() state detection and flip the game into a mode nothing is
actually running.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DZnaedMVnFLztkCsmWGVfv