feat(deauth,evilportal,capture): bulk deauth UX, Hak5-compatible Evil Portal, monitor capture fixes

- Recon AP focus sidebar: 'Deauth All Clients' with engagement-scope confirm
- Deauth Targeting card: 'Deauth All' behind the same scope confirmation
- New POST /api/attacks/deauth/bulk (max 32 targets, per-target results)
- Evil Portal tab: import EvilPortalNano-format portal zips into
  /mmc/mk8/portals, serve active portal on port 80 to unauthenticated
  clients via a minimal PHP shim, capture all form POSTs (.logs in stock
  MyPortal.php format + captures.jsonl), dnsmasq address=/#/ DNS hijack
- OpenAP: Evil Portal template dropdown (greyed when none), activated with
  the attack and stopped with it
- Monitor Capture fix: iface-less status now reports whichever monitor is
  actually capturing; pcap dir mkdir'd; tcpdump stderr surfaced instead of
  discarded

payload/user/remote_access/pager-webui/www/js/app.js

@@ -31,6 +31,7 @@ const App = (() => {
     { key: 'dashboard', label: 'Dashboard', hash: '#/dashboard', icon: 'dashboard' },
     { key: 'pineap', label: 'PineAP', hash: '#/pineap', icon: 'wifi' },
     { key: 'recon', label: 'Recon', hash: '#/recon', icon: 'recon' },
+    { key: 'evilportal', label: 'Evil Portal', hash: '#/evilportal', icon: 'portal' },
     { key: 'logging', label: 'Logging', hash: '#/logging', icon: 'logging' },
     { key: 'modules', label: 'Payloads', hash: '#/modules', icon: 'modules' },
     { key: 'harness', label: 'Harness', hash: '#/harness', icon: 'robot' },
@@ -420,6 +421,7 @@ const App = (() => {
     '#/recon': 'recon',
     '#/recon/reports': 'recon_reports',
     '#/recon/handshakes': 'recon_handshakes',
+    '#/evilportal': 'evilportal',
     '#/logging': 'logging',
     '#/logging/system': 'logging_system',
     '#/modules': 'modules',