internal/engine: state machine + orchestrator (P2.1 scope)

Idle → Starting → Active → Failed lifecycle. bringUp resolves
upstream IP, installs the driver (idempotent), runs initial procscan,
opens redirector listener, builds filter + opens WinDivert handle,
then spawns the diverter reader and 2-second procscan ticker.

On every outbound TCP packet from a target PID: record (src_port →
real_target) mapping, rewrite dst to 127.0.0.1:listener_port,
re-inject. Loopback listener picks up the connection, looks up the
original target, and SOCKS5-tunnels.

P2.1 scope: no Reconnecting state, no panic recovery, no UDP
forwarding. Those land in P2.2/P2.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/engine/state.go

@@ -0,0 +1,29 @@
+package engine
+
+// Status is the engine's lifecycle state.
+type Status string
+
+const (
+	StatusIdle     Status = "idle"
+	StatusStarting Status = "starting"
+	StatusActive   Status = "active"
+	StatusFailed   Status = "failed"
+	// Reconnecting added in P2.3.
+)
+
+// isValidTransition guards the state machine. Used by Engine.transition
+// to assert in dev/test; production code logs a warning rather than
+// panicking on invalid transitions.
+func isValidTransition(from, to Status) bool {
+	switch from {
+	case StatusIdle:
+		return to == StatusStarting
+	case StatusStarting:
+		return to == StatusActive || to == StatusFailed
+	case StatusActive:
+		return to == StatusIdle || to == StatusFailed
+	case StatusFailed:
+		return to == StatusStarting || to == StatusIdle
+	}
+	return false
+}