Add 9 advanced passive modules: VLAN, network mapper, auth tracker, SMB, cloud tokens, LDAP, RDP, QUIC, DB interceptor

Phase 2 batch 2: protocol-specific passive modules for deep network
visibility. Each module subscribes to capture_bus, parses protocol
structures with struct (no scapy), buffers SQLite writes, and publishes
bus events for cross-module correlation.

- vlan_discovery: 802.1Q/DTP/CDP/LLDP/STP/EAPOL layer-2 parsing
- network_mapper: communication graph with role classification and DOT output
- auth_flow_tracker: Kerberos/NTLM/SSH/LDAP auth correlation per user
- smb_monitor: SMB2/3 tree connect, file access, GPP/SYSVOL detection
- cloud_token_harvester: regex scan cleartext HTTP for AWS/JWT/OAuth/SAML/GCP tokens
- ldap_harvester: BER/ASN.1 LDAP parsing for AD object inventory and LAPS detection
- rdp_monitor: RDP cookie + CredSSP NTLM extraction, admin workstation detection
- quic_analyzer: QUIC Initial packet parsing with RFC 9001 key derivation for SNI
- db_interceptor: MSSQL TDS, MySQL, PostgreSQL, Redis RESP, MongoDB OP_MSG parsing

modules/passive/__init__.py

@@ -8,6 +8,15 @@ from modules.passive.kerberos_harvester import KerberosHarvester
 from modules.passive.host_discovery import HostDiscovery
 from modules.passive.os_fingerprint import OSFingerprint
 from modules.passive.traffic_analyzer import TrafficAnalyzer
+from modules.passive.vlan_discovery import VLANDiscovery
+from modules.passive.network_mapper import NetworkMapper
+from modules.passive.auth_flow_tracker import AuthFlowTracker
+from modules.passive.smb_monitor import SMBMonitor
+from modules.passive.cloud_token_harvester import CloudTokenHarvester
+from modules.passive.ldap_harvester import LDAPHarvester
+from modules.passive.rdp_monitor import RDPMonitor
+from modules.passive.quic_analyzer import QUICAnalyzer
+from modules.passive.db_interceptor import DBInterceptor
 
 __all__ = [
     "PacketCapture",
@@ -18,4 +27,13 @@ __all__ = [
     "HostDiscovery",
     "OSFingerprint",
     "TrafficAnalyzer",
+    "VLANDiscovery",
+    "NetworkMapper",
+    "AuthFlowTracker",
+    "SMBMonitor",
+    "CloudTokenHarvester",
+    "LDAPHarvester",
+    "RDPMonitor",
+    "QUICAnalyzer",
+    "DBInterceptor",
 ]