feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

systemd/cellular-proxy-watch-once.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=cellular-proxy WWAN watch once (timer)
+After=network-online.target
+ConditionPathExists=@INSTALL_DIR@/etc/settings.conf
+
+[Service]
+Type=oneshot
+EnvironmentFile=-@INSTALL_DIR@/etc/runtime.env
+EnvironmentFile=-@INSTALL_DIR@/etc/settings.conf
+ExecStart=@INSTALL_DIR@/scripts/watch-cellular.sh --once
+Nice=10
+MemoryMax=16M
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+StandardOutput=append:@LOG_DIR@/watch.log
+StandardError=append:@LOG_DIR@/watch.log