Scaffold ipswap: tray-driven Windows IP preset switcher

Implements the design in claude.md as a building skeleton: pure Go, no cgo,
cross-compiles to a single Windows .exe from Linux.

Architecture follows the spec's deliberate split. The fast path is native —
tray icon, grouped submenus, a Win32 MessageBox showing a live before/after
diff, then netsh. The slow path is an embedded web editor served on a random
loopback port and opened in the default browser.

Two decisions worth recording:

Reads use GetAdaptersAddresses, writes use netsh. The spec left the
enumeration mechanism open; parsing `netsh show config` breaks on a
non-English Windows because the output is localised. DNS static-vs-DHCP
origin is not exposed by that API, so it comes from one registry read.

The netsh command plan is built in portable code. That puts the delete-every-
existing-address step — the one that stops secondary addresses leaking across
switches — under test without needing a Windows box.

The editor requires the session token in a header for mutations, not just the
cookie: any page in the browser can make it POST to 127.0.0.1 with the cookie
attached, but it cannot set a header. The updater refuses to install a release
that publishes no SHA256.

Not yet done: no group picker for export (the API supports it), no
single-instance guard, and internal/server/web/app.css is reconstructed from
the description in claude.md rather than the canonical apointless.css.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/tray/helpers.go

@@ -0,0 +1,21 @@
+package tray
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+
+	"gitea.apointless.space/bsncubed/ipswap/internal/config"
+	"gitea.apointless.space/bsncubed/ipswap/internal/netcfg"
+)
+
+// isElevationErr reports whether a failed apply was refused for lack of
+// administrator rights, which is the one failure that has a useful next step.
+func isElevationErr(err error) bool {
+	return errors.Is(err, netcfg.ErrElevationRequired)
+}
+
+// tempDir is where update downloads land.
+func tempDir() string {
+	return filepath.Join(os.TempDir(), config.AppName)
+}