feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

systemd/cellular-proxy-watch.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=cellular-proxy WWAN watch (auto rebind on IP/link change)
+After=network-online.target cellular-proxy.service
+Wants=network-online.target
+PartOf=cellular-proxy.service
+
+[Service]
+Type=simple
+EnvironmentFile=-@INSTALL_DIR@/etc/runtime.env
+EnvironmentFile=-@INSTALL_DIR@/etc/settings.conf
+# 低内存：watch 脚本本身极轻；间隔可在 settings WATCH_INTERVAL_SEC 覆盖
+ExecStart=@INSTALL_DIR@/scripts/watch-cellular.sh
+Restart=always
+RestartSec=5
+MemoryMax=16M
+Nice=10
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+StandardOutput=append:@LOG_DIR@/watch.log
+StandardError=append:@LOG_DIR@/watch.log
+
+[Install]
+WantedBy=multi-user.target