feat: add setcap step to Setup tab for port 443 binding

Adds Step 2 in the Setup tab: grants cap_net_bind_service to the bridge
binary via pkexec/sudo so it can bind port 443 directly. On success,
automatically updates bridge_listen_addr to 0.0.0.0:443 — no iptables
rules required. Step re-detects cap state on each frame so it stays
accurate after a rebuild clears the capability.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/setup.rs

@@ -1,5 +1,26 @@
 use std::{path::{Path, PathBuf}, process::Command};
 
+// ── Port 443 capability ───────────────────────────────────────────────────────
+
+/// Check whether the bridge binary already has cap_net_bind_service set.
+pub fn bridge_has_cap443(binary: &Path) -> bool {
+    std::process::Command::new("getcap")
+        .arg(binary)
+        .output()
+        .map(|o| String::from_utf8_lossy(&o.stdout).contains("cap_net_bind_service"))
+        .unwrap_or(false)
+}
+
+/// Grant cap_net_bind_service to the bridge binary so it can bind port 443
+/// without running as root. Uses pkexec (or sudo as fallback).
+pub fn setcap_bridge_443(binary: &Path) -> anyhow::Result<()> {
+    let script = format!(
+        "setcap cap_net_bind_service=+ep '{}'",
+        binary.to_string_lossy()
+    );
+    run_elevated(&script)
+}
+
 // ── Cert installation ─────────────────────────────────────────────────────────
 
 /// Find the bridge cert in the given captures dir.