Previously, the scan processed ALL IPs through step 1 (ping), waited for
ALL to finish, then ALL survivors through step 2 (nxdomain), etc. With
1M IPs this meant waiting hours before seeing any results.

Now each worker takes ONE IP and runs it through the entire pipeline
(ping → nxdomain → resolve → e2e). If any step fails, the worker
immediately moves to the next IP. Results appear as soon as individual
IPs complete all steps.

- New RunPipeline() in scanner package: channel-based DFS pipeline
- New runPipelineScan() in scan.go: live display of passed IPs with
  metrics, single progress bar with pass/fail counts
- Each passed IP is printed immediately as it's discovered
- Works with --batch, --discover, and --resume

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Switch TUI scan from BFS (RunChainQuietCtx) to DFS (RunPipeline)
- Show overall progress bar with pass/fail counts
- Per-step breakdown shows tested/passed/rate for each step
- Live display of last 8 passed IPs with their metrics
- Add Discover and Throughput toggles to config screen
- Add throughput/dnstt step to pipeline when enabled

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Keep ALL passed IPs during scan (not just last 8)
- Scrollable results table in TUI with ↑/↓ keys and all metrics
- Auto-scroll to latest result, manual scroll to review history
- Live append each passed IP to _ips.txt immediately (both CLI and TUI)
- Results file available during scan, not just at the end

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add DFS pipeline description (EN + FA): each worker runs one IP through
  all steps, results appear instantly, IPs live-appended to file
- Document --query-size and --cidr-file flags (both EN and FA tables)
- Fix e2e-timeout default: 20 → 30 (matches root.go)
- Add live file append note to --output-ips description
- Add DFS pipeline to features table (EN + FA)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…hput

DFS pipeline, neighbor discovery, throughput test, and TUI overhaul

For dnstt setups requiring SOCKS5 authentication, the e2e test now
supports RFC 1929 username/password negotiation via --socks-user and
--socks-pass flags. When credentials are provided, the SOCKS5 handshake
uses method 0x02 instead of 0x00 (no-auth).

Also adds --connect-addr to configure the SOCKS5 CONNECT target. Default
remains example.com:80, but setting it to host:22 enables SSH banner
verification — proving the tunnel can reach an SSH server.

Changes:
- Add SOCKS5Opts type and socks5Handshake/socks5Connect helpers
- Update all e2e/throughput check functions to accept SOCKS5Opts
- Add --socks-user, --socks-pass, --connect-addr to scan, chain,
  e2e dnstt, e2e slipstream, and doh e2e commands
- Add SOCKS User/Pass/Connect Addr fields to TUI config (E2E section)
- Update README (EN + FA) with new flags and examples

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The welcome screen's CLI Flags mode (paste flags to pre-fill config)
was missing --discover, --throughput, --socks-user, --socks-pass, and
--connect-addr. Users pasting CLI flags in the TUI now get all options
applied correctly. Also updates the CLI examples shown in the welcome
screen.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fixes all issues raised in SamNet-dev#7 review:

1. Fix goroutine leak in pipeline.go: add WaitGroup for workers,
   drain results channel on cancellation. No goroutines left behind.

2. Make DFS opt-in (--dfs flag): BFS (RunChainQuietCtx) remains the
   default, proven pipeline. DFS is available for users who want
   instant results on large scans.

3. Add --discover-max flag: caps IPs per discovery round to prevent
   unbounded scan explosion (e.g. --discover-max 1000).

4. Fix throughput false negatives: lower minimum from 100 bytes to
   any data (1+ bytes). A valid HTTP redirect or short response
   still proves payload flows through the tunnel.

5. Fix IP file overwrite: in DFS mode, saveResults skips WriteIPList
   since the file is already live-appended by the pipeline.

6. Discovery rounds use the same BFS/DFS mode as the main scan
   (via runScanChunk helper).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>