Ignore ARP replies in last_seen updates to block AP proxy spoofing

AP ARP proxy sends REPLY frames with the disconnected client's MAC as
the Ethernet source. Treating those as genuine device signals kept
last_seen fresh, preventing the watchdog from detecting departure.

Only ARP REQUEST (opcode 1) frames originate from the device itself.
Skip _update_last_seen() for opcode 2 (REPLY) frames.

net_alerter/net_alerter.py

@@ -1540,7 +1540,11 @@ def parse_frame(data: bytes) -> None:
         
         # Branch A: ARP frame (ethertype 0x0806)
         if eth_type == 0x0806:
-            _update_last_seen(src_mac)
+            # Only ARP requests (opcode 1) are genuine device-originated signals.
+            # ARP replies (opcode 2) may be AP ARP proxy forgeries: the AP answers
+            # on behalf of disconnected clients with the client MAC as Ethernet source.
+            if len(data) >= 22 and struct.unpack('!H', data[20:22])[0] == 1:
+                _update_last_seen(src_mac)
             # Ingest ARP signal for multi-source device identity
             _ingest_signal(src_mac, 'arp')
             return