internal/engine: state machine + orchestrator (P2.1 scope)

Idle → Starting → Active → Failed lifecycle. bringUp resolves
upstream IP, installs the driver (idempotent), runs initial procscan,
opens redirector listener, builds filter + opens WinDivert handle,
then spawns the diverter reader and 2-second procscan ticker.

On every outbound TCP packet from a target PID: record (src_port →
real_target) mapping, rewrite dst to 127.0.0.1:listener_port,
re-inject. Loopback listener picks up the connection, looks up the
original target, and SOCKS5-tunnels.

P2.1 scope: no Reconnecting state, no panic recovery, no UDP
forwarding. Those land in P2.2/P2.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/engine/engine_test.go

@@ -0,0 +1,45 @@
+//go:build windows && integration
+
+package engine
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestEngine_StartStop_Smoke is an integration test that requires:
+//   - admin
+//   - reachable upstream SOCKS5 proxy
+//   - WinDivert v2.2.2 driver available (or auto-installed)
+//
+// Build tag: integration. Run with:
+//
+//	go test -tags integration ./internal/engine/... -run TestEngine_StartStop_Smoke
+//
+// On a clean dev box this is the canary that proves the full pipeline
+// is wired correctly.
+func TestEngine_StartStop_Smoke(t *testing.T) {
+	cfg := Config{
+		ProxyAddr: "95.165.72.59:12334",
+		Targets:   []string{"explorer.exe"}, // safe target — won't actually proxy anything important
+	}
+	e, err := New(cfg)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	require.NoError(t, e.Start(ctx))
+
+	// Should reach Active within a few seconds
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) && e.Status() != StatusActive {
+		time.Sleep(50 * time.Millisecond)
+	}
+	require.Equal(t, StatusActive, e.Status())
+
+	require.NoError(t, e.Stop())
+	require.Equal(t, StatusIdle, e.Status())
+}