Phase 4: Active modules, templates, and operator scripts

Active modules (9 files in modules/active/):
- bettercap_mgr: Central bettercap orchestrator with REST API health
  monitoring, event stream parsing, crash recovery with corrective
  gratuitous ARPs, caplet management, and process disguise
- arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings
- dns_poison: DNS poisoning with zone template loading support
- dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection
- evil_twin: hostapd-based rogue AP with captive portal and dnsmasq,
  iptables redirect, credential capture via HTTP POST handler
- ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse
- responder_mgr: Responder subprocess manager with hash file monitoring,
  NTLMv1/v2 parsing, session log scanning, relay target coordination
- mitmproxy_mgr: Transparent proxy with addon scripts, tier checking
  (OPi Zero 3+ only), iptables setup, credential/token extraction
- ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP,
  LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS

Templates (9 files):
- 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN
  (self-contained HTML with inline CSS, realistic login forms)
- 2 DNS zones: redirect-all and selective Jinja2 template
- 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates
- 1 Responder.conf Jinja2 template with protocol toggles

Operator scripts (6 files in scripts/operator/):
- pull_data.sh: rsync structured data over WireGuard/Tailscale
- extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction
- extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert
- extract_emails.sh: SMTP email extraction with attachment detection
- crack_hashes.sh: Export creds to hashcat format, optional auto-crack
- generate_report.py: SQLite-to-Markdown/HTML engagement report generator

modules/active/__init__.py

@@ -0,0 +1,23 @@
+"""BigBrother active modules — MITM, spoofing, and interception."""
+
+from modules.active.bettercap_mgr import BettercapManager
+from modules.active.arp_spoof import ARPSpoof
+from modules.active.dns_poison import DNSPoison
+from modules.active.dhcp_spoof import DHCPSpoof
+from modules.active.evil_twin import EvilTwin
+from modules.active.ipv6_slaac import IPv6SLAAC
+from modules.active.responder_mgr import ResponderManager
+from modules.active.mitmproxy_mgr import MitmproxyManager
+from modules.active.ntlm_relay import NTLMRelay
+
+__all__ = [
+    "BettercapManager",
+    "ARPSpoof",
+    "DNSPoison",
+    "DHCPSpoof",
+    "EvilTwin",
+    "IPv6SLAAC",
+    "ResponderManager",
+    "MitmproxyManager",
+    "NTLMRelay",
+]