Add WiFi hotspot port forwarding with bind address selection

[steffen-heil-secforge]

Summary

Enables port forwards to bind to the WiFi hotspot interface, allowing devices connected to the Android device's hotspot to access forwarded services. This complements the existing localhost and all-interfaces bind options.

Features

WiFi Hotspot Binding

• New bind address option for WiFi hotspot (access_point constant)
• Automatic detection of hotspot interface IP via NetworkInterface API
• Filters out cellular interfaces (rmnet*, v4-rmnet*, clat*, ccmni*) to correctly identify hotspot
• Background monitoring that retries failed hotspot forwards when hotspot state changes

UI Enhancements

• Bind address spinner in port forward editor with three options:
  • localhost (127.0.0.1)
  • All interfaces (0.0.0.0)
  • WiFi hotspot (auto-detected IP)
• Visual security warnings for network-exposed binds (all interfaces and hotspot)
• Toast notifications when hotspot is unavailable

Database Migration (v26 → v27)

• Add `bindaddr` column to `portforwards` table
• Default value: `localhost` for backward compatibility
• Existing port forwards automatically bound to localhost

Thread Safety

• Synchronized helper methods for bridge list access: `getBridgesCopy()`, `hasBridges()`, `getBridgeCount()`
• Prevents concurrent modification exceptions during background monitoring
• Fixed TOCTOU race in `onUnbind()` by using single snapshot

Implementation Details

Network Detection (NetworkUtils)

• `getHotspotInterfaceIP()`: Detects current hotspot interface IP address
• `hasAccessPointStateChanged()`: Sentinel-based state change detection
  • Tracks last known hotspot IP
  • Only updates sentinel on actual state changes
  • Read-only `getAccessPointIP()` prevents UI queries from polluting state

Background Monitoring (TerminalManager.ApStateMonitorTask)

• Runs every 10 seconds to check for hotspot state changes
• Automatically retries failed `access_point` forwards when:
  • Hotspot is activated
  • Hotspot is deactivated (stops retry attempts)
  • Hotspot IP changes (different network configuration)

Validation

• Port forward validation prevents binding to `access_point` when hotspot is not active
• User-friendly error messages guide selection of appropriate bind address

Database Schema

```sql
ALTER TABLE portforwards ADD COLUMN bindaddr TEXT DEFAULT 'localhost';
```

[steffen-heil-secforge]

Superseded by #8 (ported to new Kotlin/Compose/Room architecture)