Add 8 passive network observation modules (Phase 2)

- PacketCapture: tcpdump subprocess with zstd compression + AES-256-GCM encryption, disk auto-purge
- DNSLogger: DNS query/response parsing with DoH detection, batch SQLite writes
- TLSSNIExtractor: TLS ClientHello SNI extraction with TCP reassembly for fragments
- CredentialSniffer: FTP/HTTP Basic/form POST/SNMP/LDAP/NTLMv1v2 credential extraction
- KerberosHarvester: AS-REQ/AS-REP/TGS-REP parsing for hashcat modes 7500/18200/13100
- HostDiscovery: ARP/DHCP/mDNS/NetBIOS/SSDP/LLMNR passive host inventory with OUI lookup
- OSFingerprint: p0f-style TCP SYN analysis + HTTP UA/SSH banner/SMB dialect fingerprinting
- TrafficAnalyzer: flow tracking, protocol distribution, top talkers, beacon detection

All modules extend BaseModule, use capture_bus subscription, struct-based parsing
(no scapy), batch SQLite writes, and publish bus events.

modules/passive/__init__.py

@@ -0,0 +1,21 @@
+"""BigBrother passive modules — zero-noise network observation."""
+
+from modules.passive.packet_capture import PacketCapture
+from modules.passive.dns_logger import DNSLogger
+from modules.passive.tls_sni_extractor import TLSSNIExtractor
+from modules.passive.credential_sniffer import CredentialSniffer
+from modules.passive.kerberos_harvester import KerberosHarvester
+from modules.passive.host_discovery import HostDiscovery
+from modules.passive.os_fingerprint import OSFingerprint
+from modules.passive.traffic_analyzer import TrafficAnalyzer
+
+__all__ = [
+    "PacketCapture",
+    "DNSLogger",
+    "TLSSNIExtractor",
+    "CredentialSniffer",
+    "KerberosHarvester",
+    "HostDiscovery",
+    "OSFingerprint",
+    "TrafficAnalyzer",
+]