feat: Attacks UI (Overview + Evil WPA/Open/Enterprise launchers)

Side-menu Attacks section with deploy/stop launchers, live status card
(device truth), monitor capture toggle, hashcat .hc22000 export + download,
deauth targeting panel, enterprise cred tables and PineAPE toggles.

payload/user/remote_access/pager-webui/server.py

@@ -3133,6 +3133,18 @@ def h_attacks_export_hc22000(ctx):
                   'hashcat': 'hashcat -m 22000 %s -a 0 wordlist.txt' % outname}
 
 
+def h_attacks_download_hc22000(ctx):
+    name = _unquote_plus(ctx.args[0])
+    if not re.match(r'^handshakes_\d+\.hc22000$', name):
+        return 400, {'error': 'invalid name'}
+    full = os.path.join('/root/loot/hc22000', name)
+    if not os.path.isfile(full):
+        return 404, {'error': 'not found'}
+    with open(full, 'rb') as f:
+        body = f.read()
+    return 200, Download(body, 'application/octet-stream', name)
+
+
 def h_attacks_deauth(ctx):
     body = ctx.body or {}
     bssid = (body.get('bssid') or '').strip().upper()
@@ -4277,6 +4289,7 @@ ROUTER.add('POST', r'/api/attacks/stop', h_attacks_stop)
 ROUTER.add('GET', r'/api/attacks/status', h_attacks_status)
 ROUTER.add('POST', r'/api/attacks/capture', h_attacks_capture)
 ROUTER.add('GET', r'/api/attacks/export/hc22000', h_attacks_export_hc22000)
+ROUTER.add('GET', r'/api/attacks/export/hc22000/([^/]+)', h_attacks_download_hc22000)
 ROUTER.add('POST', r'/api/attacks/deauth', h_attacks_deauth)
 ROUTER.add('GET', r'/api/attacks/clients', h_attacks_clients)
 ROUTER.add('GET', r'/api/health', h_health)