Live packet capture (WebSocket)
GET/capture/ws/:namespace/:podName/:interface
Injects an ephemeral tshark container into the pod (sharing its network namespace) and streams a live capture of one interface. Control frames are JSON ({type:"meta"|"status"|"error"}); every other text frame is one packet row as tab-separated Wireshark columns (No, Time, Source, Destination, Protocol, Length, Info). Closing the socket stops the capture. Optional filter is a BPF capture filter; optional container reuses an existing capture container on reconnect.