feat: bind_interface-only by default + WWAN watch auto-rebind

- Default BIND_SOURCE_IP=false: do not pin inet4_bind_address (stale
  source IP after WWAN re-dial was the main rep=0x01 cause).
- Add scripts/watch-cellular.sh: ip monitor events + poll, regenerate
  when iface missing or pinned source IP drifts.
- systemd: cellular-proxy-watch.service + 2min timer oneshot fallback.
- cpxy watch {status|once|start|stop|logs}
- Install/upgrade enable watch when ENABLE_CELLULAR_WATCH=true.

systemd/cellular-proxy-watch.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=cellular-proxy WWAN watch timer (fallback oneshot)
+Requires=cellular-proxy-watch-once.service
+
+[Timer]
+# 兜底：即使 long-running watch 挂了，也每 2 分钟 oneshot 检查
+OnBootSec=1min
+OnUnitActiveSec=2min
+AccuracySec=30s
+Persistent=true
+Unit=cellular-proxy-watch-once.service
+
+[Install]
+WantedBy=timers.target