feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

scripts/lib.sh

@@ -31,8 +31,11 @@ load_config() {
   LOG_DIR="${LOG_DIR:-/var/log/cellular-proxy}"
   CELLULAR_IFACE="${CELLULAR_IFACE:-}"
   CELLULAR_SOURCE_IP="${CELLULAR_SOURCE_IP:-}"
+  BIND_SOURCE_IP="${BIND_SOURCE_IP:-false}"
   REQUIRE_CELLULAR_IFACE="${REQUIRE_CELLULAR_IFACE:-true}"
   CELLULAR_IFACE_PATTERNS="${CELLULAR_IFACE_PATTERNS:-wwan,wwp,usb,enx,ppp,cdc,rmnet,ccmni,mbim,qmi}"
+  ENABLE_CELLULAR_WATCH="${ENABLE_CELLULAR_WATCH:-true}"
+  WATCH_INTERVAL_SEC="${WATCH_INTERVAL_SEC:-60}"
   PROXY_LISTEN_HOST="${PROXY_LISTEN_HOST:-0.0.0.0}"
   PROXY_MIXED_PORT="${PROXY_MIXED_PORT:-7890}"
   PROXY_USER="${PROXY_USER:-}"