feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

scripts/install.sh

@@ -160,6 +160,23 @@ case "$cmd" in
   auth)
     exec "$BASE/scripts/apply-proxy-auth.sh" "$@"
     ;;
+  watch)
+    case "${1:-status}" in
+      once) exec "$BASE/scripts/watch-cellular.sh" --once ;;
+      status)
+        systemctl status cellular-proxy-watch.service --no-pager 2>/dev/null || true
+        systemctl status cellular-proxy-watch.timer --no-pager 2>/dev/null || true
+        ;;
+      start|enable)
+        systemctl enable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+        ;;
+      stop|disable)
+        systemctl disable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+        ;;
+      logs) journalctl -u cellular-proxy-watch -n "${2:-80}" --no-pager ;;
+      *) exec "$BASE/scripts/watch-cellular.sh" "$@" ;;
+    esac
+    ;;
   upgrade)
     # 一条命令在线增量升级（保留密钥/网卡）
     if [[ -x "$BASE/scripts/online-upgrade.sh" ]]; then
@@ -178,6 +195,7 @@ cpxy — cellular-proxy
   cpxy verify | logs [N]
   cpxy auth --user U --pass P   # 设置 7890 代理账号密码
   cpxy auth --clear | --show
+  cpxy watch [status|once|start|stop|logs]  # WWAN 自动监控
   cpxy upgrade                  # 一条命令在线增量升级
   cpxy upgrade --ui-only        # 只更新面板
   cpxy upgrade --force-binary   # 强制重下 sing-box
@@ -204,6 +222,19 @@ if [[ -f "$ROOT_DIR/systemd/cellular-proxy-admin.service" ]]; then
   install -m 0644 "$ROOT_DIR/systemd/cellular-proxy-admin.service" /etc/systemd/system/cellular-proxy-admin.service
   sed -i "s|@INSTALL_DIR@|$INSTALL_DIR|g" /etc/systemd/system/cellular-proxy-admin.service
 fi
+# WWAN 自动监控：事件驱动 + 定时兜底
+install_watch_units() {
+  local u
+  for u in cellular-proxy-watch.service cellular-proxy-watch-once.service cellular-proxy-watch.timer; do
+    if [[ -f "$ROOT_DIR/systemd/$u" ]]; then
+      install -m 0644 "$ROOT_DIR/systemd/$u" "/etc/systemd/system/$u"
+      sed -i "s|@INSTALL_DIR@|$INSTALL_DIR|g" "/etc/systemd/system/$u"
+      sed -i "s|@LOG_DIR@|${LOG_DIR}|g" "/etc/systemd/system/$u"
+    fi
+  done
+  chmod +x "$INSTALL_DIR/scripts/watch-cellular.sh" 2>/dev/null || true
+}
+install_watch_units
 systemctl daemon-reload
 
 info "5/6 启动服务"
@@ -239,6 +270,21 @@ else
   fi
 fi
 
+# 默认开启 watch（ENABLE_CELLULAR_WATCH!=false）
+watch_flag="$(echo "${ENABLE_CELLULAR_WATCH:-true}" | tr '[:upper:]' '[:lower:]')"
+if [[ "$watch_flag" == "false" || "$watch_flag" == "0" || "$watch_flag" == "no" ]]; then
+  systemctl disable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+  info "ENABLE_CELLULAR_WATCH=false，未启用自动监控"
+else
+  systemctl enable cellular-proxy-watch.service 2>/dev/null || true
+  systemctl enable cellular-proxy-watch.timer 2>/dev/null || true
+  if [[ "$SKIP_START" != "true" ]]; then
+    systemctl restart cellular-proxy-watch.service 2>/dev/null || true
+    systemctl restart cellular-proxy-watch.timer 2>/dev/null || true
+  fi
+  info "已启用 cellular-proxy-watch（网卡/源 IP 变化自动 rebind）"
+fi
+
 info "6/6 自动验证出口（短超时，失败不阻塞安装结束）"
 if [[ "$SKIP_START" != "true" && "$AUTO_VERIFY" == "true" ]]; then
   set +e