Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api

9 files in utils/ providing the shared infrastructure layer:
- crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management
- networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation
- logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth
- stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable
- resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring
- permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement
- config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload
- bettercap_api: REST client with per-session random credentials, session/events/command methods

data/bpf_filters/credentials.bpf

@@ -0,0 +1,2 @@
+# HTTP Basic/NTLM auth, FTP, Telnet, SMTP, POP3, IMAP, LDAP bind, Kerberos AS-REQ
+port 80 or port 21 or port 23 or port 25 or port 110 or port 143 or port 389 or port 88 or port 445

data/bpf_filters/discovery.bpf

@@ -0,0 +1,2 @@
+# ARP, DHCP, mDNS, SSDP, LLMNR, NetBIOS
+arp or port 67 or port 68 or port 5353 or port 1900 or port 5355 or port 137 or port 138

data/bpf_filters/dns.bpf

@@ -0,0 +1 @@
+port 53

data/bpf_filters/full_capture.bpf

@@ -0,0 +1 @@
+# Everything — no filter