Add bounded TCP payload evidence for PCAP analysis

[Adam-Ghanem]

Summary

• add bounded TCP data-plane evidence derived from existing metadata-only TCP segment lengths
• report observed payload segments/bytes, first-observed originator vs responder payload bytes, and bidirectional vs unidirectional payload flows
• report missing segment-length metadata explicitly instead of guessing from Ethernet frame length
• integrate the summary into classic PCAP analysis as tcp_payload_evidence
• add focused regression tests for directionality, missing metadata, non-TCP exclusion, bounds, and truncation

Why

NetWatch now reports TCP conversation completeness, but the existing flow history does not itself encode payload events. PCAP imports already extract exact TCP segment lengths without retaining payload content. This change exposes that evidence directly and safely so analysts can distinguish control-only conversations from data-bearing traffic without storing application payloads.

Research basis

Wireshark TCP completeness explicitly separates DATA evidence from SYN/SYN-ACK/ACK/FIN/RST evidence. Zeek connection metadata likewise exposes directional byte counts while retaining connection-level history. NetWatch keeps its own representation and conservative privacy boundary rather than copying either product.

Safety

Metadata-only; no payload bytes are retained, reconstructed, searched, replayed, or exported by this feature. Processing is bounded to 10,000 records per summary.