Add Phase 3 connectivity modules — 8 modules + bridge scripts

WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).

Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).

scripts/teardown_bridge.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Teardown bridge and restore interfaces
+#
+# Removes the transparent bridge, flushes ebtables rules, and restores
+# the original interface state.  Safe to call even if the bridge is
+# already down or partially broken.
+
+set -uo pipefail
+# Note: no -e — we want all cleanup steps to run even if some fail
+
+BRIDGE="br0"
+
+echo "Tearing down bridge $BRIDGE"
+
+# --------------------------------------------------------------------------
+# Identify bridge members before removal
+# --------------------------------------------------------------------------
+MEMBERS=()
+if ip link show "$BRIDGE" &>/dev/null; then
+    while IFS= read -r line; do
+        iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
+        if [[ -n "$iface" ]]; then
+            MEMBERS+=("$iface")
+        fi
+    done < <(bridge link show master "$BRIDGE" 2>/dev/null | grep -oP '^\d+:\s+\K\S+')
+fi
+
+# --------------------------------------------------------------------------
+# Remove ebtables rules
+# --------------------------------------------------------------------------
+if command -v ebtables &>/dev/null; then
+    echo "Flushing ebtables rules"
+    ebtables -F 2>/dev/null || true
+    ebtables -X 2>/dev/null || true
+fi
+
+# --------------------------------------------------------------------------
+# Bring bridge down
+# --------------------------------------------------------------------------
+ip link set down dev "$BRIDGE" 2>/dev/null || true
+
+# --------------------------------------------------------------------------
+# Remove interfaces from bridge and restore state
+# --------------------------------------------------------------------------
+for iface in "${MEMBERS[@]}"; do
+    echo "Restoring interface: $iface"
+
+    # Remove from bridge
+    ip link set "$iface" nomaster 2>/dev/null || true
+
+    # Disable promiscuous mode
+    ip link set "$iface" promisc off 2>/dev/null || true
+
+    # Re-enable IPv6
+    sysctl -qw "net.ipv6.conf.${iface}.disable_ipv6=0" 2>/dev/null || true
+
+    # Bring interface up (in case it was downed)
+    ip link set up dev "$iface" 2>/dev/null || true
+done
+
+# --------------------------------------------------------------------------
+# Delete bridge device
+# --------------------------------------------------------------------------
+if ip link show "$BRIDGE" &>/dev/null; then
+    ip link del "$BRIDGE" 2>/dev/null || true
+    echo "Bridge $BRIDGE deleted"
+else
+    echo "Bridge $BRIDGE already removed"
+fi
+
+# --------------------------------------------------------------------------
+# Re-enable IPv6 globally on bridge name (cleanup)
+# --------------------------------------------------------------------------
+sysctl -qw "net.ipv6.conf.${BRIDGE}.disable_ipv6=0" 2>/dev/null || true
+
+# --------------------------------------------------------------------------
+# Verify cleanup
+# --------------------------------------------------------------------------
+if ip link show "$BRIDGE" &>/dev/null; then
+    echo "Warning: bridge $BRIDGE still exists after teardown" >&2
+    exit 1
+else
+    echo "Bridge teardown complete"
+    exit 0
+fi