feat(net,gui): real internet access -- redirects, HTTPS guard, netcheck, and a live ONLINE indicator

The stack could already reach the real internet once the UDP-checksum and
scheduler fixes landed; this makes it work on real-world URLs and gives the
desktop a first-class "is the internet up?" answer.

HTTP client
  - Follows 3xx redirects (Location header, absolute or relative) up to five
    hops, so a bare host that 301s to a path or a canonical host resolves to
    actual content. Verified: `webget google.com/` follows the 301 to
    www.google.com and returns its HTTP 200 homepage.
  - Refuses https:// targets -- at the initial URL and on redirect -- with a
    clear message instead of speaking plaintext to port 443 and timing out.
  - Split the URL parser out so both the initial request and redirect targets
    go through the same path; added a case-insensitive header finder.

netcheck (CLI)
  One command that walks the whole chain -- link, address, gateway ping, DNS,
  and a real HTTP fetch -- and reports each PASS/FAIL, ending in ONLINE or
  DEGRADED. The one-shot answer to "is the internet working?".

Network Monitor (GUI)
  A live Internet: ONLINE/OFFLINE badge with the resolved IP, HTTP status and
  latency. It auto-probes once on open and re-checks on the Check button, all
  through the async HTTP worker so the window never blocks.

Verified against the real internet through QEMU's NAT: DNS resolved
example.com to a live Cloudflare address; `netcheck` passed all five layers
(Internet: ONLINE); the GUI badge showed "ONLINE 104.20.23.154 HTTP 200 240
ms"; redirect following and the HTTPS refusal both behaved. Builds clean on
x86_64, aarch64 and armv8i.

Known limit: no TLS, so HTTPS URLs are reported rather than fetched -- plain
HTTP only.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

include/net/http_client.h

@@ -31,6 +31,7 @@ typedef struct http_fetch {
     char     host[128];
     char     path[256];
     uint16_t port;
+    bool     tls;             // the URL asked for https, which we cannot speak
 
     // Result. `state` is the only field the requester may read while the fetch
     // is in flight; everything else is valid once state != RUNNING.
@@ -41,10 +42,11 @@ typedef struct http_fetch {
     int      len;             // bytes stored
     int      cap;             // buffer capacity
 
-    uint32_t ip;              // resolved peer address
+    uint32_t ip;              // resolved peer address (of the final hop)
     int      status_code;     // parsed HTTP status, 0 if not found
-    uint32_t elapsed_ms;      // wall time of the fetch
-    char     err[64];         // human-readable failure reason
+    uint32_t elapsed_ms;      // wall time of the whole fetch
+    int      redirects;       // number of 3xx hops followed
+    char     err[96];         // human-readable failure reason
 } http_fetch_t;
 
 // Start the worker thread. Call once at boot, after the TCP stack is up.