feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

scripts/upgrade.sh

@@ -273,6 +273,23 @@ case "$cmd" in
   auth)
     exec "$BASE/scripts/apply-proxy-auth.sh" "$@"
     ;;
+  watch)
+    case "${1:-status}" in
+      once) exec "$BASE/scripts/watch-cellular.sh" --once ;;
+      status)
+        systemctl status cellular-proxy-watch.service --no-pager 2>/dev/null || true
+        systemctl status cellular-proxy-watch.timer --no-pager 2>/dev/null || true
+        ;;
+      start|enable)
+        systemctl enable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+        ;;
+      stop|disable)
+        systemctl disable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+        ;;
+      logs) journalctl -u cellular-proxy-watch -n "${2:-80}" --no-pager ;;
+      *) exec "$BASE/scripts/watch-cellular.sh" "$@" ;;
+    esac
+    ;;
   logs)    journalctl -u cellular-proxy -n "${1:-80}" -f ;;
   help|*)
     cat <<H
@@ -281,6 +298,7 @@ cpxy — cellular-proxy
   cpxy detect | rebind | generate | start | stop | restart | status
   cpxy verify | logs [N]
   cpxy auth --user U --pass P | --clear | --show
+  cpxy watch [status|once|start|stop|logs]  # WWAN 自动监控
   cpxy upgrade                  # 一条命令在线增量升级
   cpxy upgrade --ui-only | --force-binary | --verify
 H
@@ -305,6 +323,15 @@ if [[ -f "$ROOT_DIR/systemd/cellular-proxy-admin.service" ]]; then
   install -m 0644 "$ROOT_DIR/systemd/cellular-proxy-admin.service" /etc/systemd/system/cellular-proxy-admin.service
   sed -i "s|@INSTALL_DIR@|$INSTALL_DIR|g" /etc/systemd/system/cellular-proxy-admin.service
 fi
+# WWAN 自动监控
+for u in cellular-proxy-watch.service cellular-proxy-watch-once.service cellular-proxy-watch.timer; do
+  if [[ -f "$ROOT_DIR/systemd/$u" ]]; then
+    install -m 0644 "$ROOT_DIR/systemd/$u" "/etc/systemd/system/$u"
+    sed -i "s|@INSTALL_DIR@|$INSTALL_DIR|g" "/etc/systemd/system/$u"
+    sed -i "s|@LOG_DIR@|${LOG_DIR}|g" "/etc/systemd/system/$u"
+  fi
+done
+chmod +x "$INSTALL_DIR/scripts/watch-cellular.sh" 2>/dev/null || true
 systemctl daemon-reload
 
 export SYSTEMD_PAGER=cat
@@ -335,6 +362,20 @@ else
   fi
 fi
 
+watch_flag="$(echo "${ENABLE_CELLULAR_WATCH:-true}" | tr '[:upper:]' '[:lower:]')"
+if [[ "$watch_flag" == "false" || "$watch_flag" == "0" || "$watch_flag" == "no" ]]; then
+  systemctl disable --now cellular-proxy-watch.service cellular-proxy-watch.timer 2>/dev/null || true
+  info "ENABLE_CELLULAR_WATCH=false，未启用自动监控"
+else
+  systemctl enable cellular-proxy-watch.service 2>/dev/null || true
+  systemctl enable cellular-proxy-watch.timer 2>/dev/null || true
+  if [[ "$SKIP_START" != "true" ]]; then
+    systemctl restart cellular-proxy-watch.service 2>/dev/null || true
+    systemctl restart cellular-proxy-watch.timer 2>/dev/null || true
+  fi
+  info "已启用 cellular-proxy-watch（网卡/源 IP 变化自动 rebind）"
+fi
+
 if [[ "$DO_VERIFY" == "true" && "$SKIP_START" != "true" ]]; then
   info "出口验证…"
   set +e