feat(net,gui): TCP listen/accept, and a Network Monitor to watch it

Kernel: the passive-open half of TCP. tcp_listen claims a port, inbound
SYNs to it are completed by the receive path, and the finished
connections queue in a backlog until tcp_accept collects them. Accepted
connections run the same stream state machine as active opens, so
tcp_send/tcp_recv/tcp_close work on them unchanged. sys_listen and
sys_accept expose this through the BSD socket API, with sys_accept
returning a fresh descriptor and leaving the listener available for the
next caller. The built-in sshd and httpd predate this and are still
answered inline from the receive path; the role they use is now named
TCP_ROLE_SERVICE to keep that distinction explicit.

GUI: a Network Monitor app. Interface configuration and link state, a
rolling dual-line chart of receive and transmit rates sampled from the
NIC counters on a fixed 2 Hz cadence (so it reads in packets per half
second no matter how often the compositor repaints), byte and packet
totals, and the TCP engine's connection table with each connection's real
state and direction, scrollable when it outgrows the window.

Two bugs the monitor made visible, both fixed:

  - Served HTTP connections were never closed. The response advertises
    "Connection: close" but the engine left the connection ESTABLISHED
    forever, so the 32-entry table filled up and the server stopped
    answering after 32 requests. The service path now sends its FIN after
    the response and lingers in TIME_WAIT until the reaper takes it. 40
    sequential requests through a 32-slot table now yield 39 successes
    where the 33rd onwards previously failed permanently.

  - tcp_close gave up in FIN_WAIT2 after 500 ms and freed the slot, so a
    peer whose own FIN arrived later got an RST instead of an ACK. It now
    falls into TIME_WAIT instead, and TIME_WAIT acknowledges a first FIN
    rather than only a retransmitted one. Expired TIME_WAIT entries are
    also reaped from tcp_get_connections_count, so a table that sees no
    further connections still empties out.

Verified on x86_64 against real peers, checked packet by packet in a
capture: a host client connected to `tcpserve 9000` in the guest and got
its reply -- SYN/SYN-ACK/ACK with a random ISN, 30-byte request, 43-byte
reply, and a clean four-way close whose final ACK is correct even when
the peer's FIN arrives 1.2 s late. Zero bad checksums throughout. The
monitor was screenshotted under live load showing connections moving
through TIME_WAIT and being reclaimed. Builds clean on x86_64, aarch64
and armv8i.

Known limit: 32 connection slots with a 2 s TIME_WAIT linger means
sustained rates much above ~16 requests/second can transiently exhaust
the table; it recovers on its own as entries expire.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

include/net/tcp.h

@@ -34,10 +34,17 @@ typedef struct {
     uint16_t urgent_pointer;
 } __attribute__((packed)) tcp_header_t;
 
-// Which end opened the connection. Server connections are created by an
-// inbound SYN to a listening service; client connections by tcp_connect().
-#define TCP_ROLE_SERVER 0
-#define TCP_ROLE_CLIENT 1
+// Which end opened the connection, and how it is serviced.
+//
+//   SERVICE  -- created by an inbound SYN to one of the built-in servers
+//               (sshd, httpd), which are answered inline from the receive
+//               path and never hand a stream back to a caller.
+//   CLIENT   -- opened by tcp_connect().
+//   ACCEPTED -- opened by a peer against a tcp_listen() port and handed to
+//               tcp_accept(). Carries a byte stream exactly like a CLIENT.
+#define TCP_ROLE_SERVICE  0
+#define TCP_ROLE_CLIENT   1
+#define TCP_ROLE_ACCEPTED 2
 
 #define TCP_RX_BUF_SIZE 4096
 #define TCP_MSS         1460
@@ -103,6 +110,31 @@ bool tcp_is_established(const tcp_conn_t* c);
 // True once the peer's FIN has been received, so no further data can arrive.
 bool tcp_peer_closed(const tcp_conn_t* c);
 
+// --- Passive open (server side) -----------------------------------------
+//
+// tcp_listen claims a port; inbound SYNs to it are completed by the receive
+// path and the finished connections queue up until tcp_accept collects them.
+// This is the general path: the built-in sshd and httpd predate it and are
+// still answered inline, so listening on their ports is not useful.
+
+#define TCP_MAX_LISTENERS 8
+#define TCP_BACKLOG_MAX   4
+
+// Returns 0 on success, -1 if the port is taken or the table is full.
+int  tcp_listen(uint16_t port, int backlog);
+
+// Collect the next established connection, waiting up to timeout_ms.
+// Returns NULL if none arrived. The caller owns it and must tcp_close it.
+tcp_conn_t* tcp_accept(uint16_t port, uint32_t timeout_ms);
+
+// Stop listening. Connections already accepted are unaffected; any still
+// waiting in the backlog are reset.
+void tcp_unlisten(uint16_t port);
+
+int      tcp_get_listener_count(void);
+uint16_t tcp_get_listener_port(int idx);
+int      tcp_get_listener_backlog(int idx);
+
 size_t tcp_get_connections_count(void);
 const tcp_conn_t* tcp_get_connection(size_t index);
 const char* tcp_state_name(uint8_t state);