feat: TCP session reconstruction with application-layer payload decoding

[NotYuSheng]

Closes #139

Summary

• SessionReconstructionService — on-demand tshark-based stream reassembly: auto-detects TCP vs UDP transport (so HTTP, TLS, FTP-DATA, DNS etc. all work), tries both endpoint directions, truncates at 1 MB
• SessionResponse DTO — ordered client/server chunks, parsed HTTP exchanges (headers, gzip decompression, chunked transfer decoding), truncation flag, graceful error messages
• GET /api/conversations/{conversationId}/session — new endpoint
• Session tab in ConversationDetail — Wireshark-style interleaved single-pane stream (client=red, server=blue); HTTP conversations add a Parsed HTTP view with collapsible request/response blocks

Test plan

• Open an HTTP conversation → Session tab → Reconstruct → verify Parsed HTTP view shows request/response blocks with headers and body
• Toggle to Raw Stream view → verify interleaved red/blue pane
• Open an FTP-DATA conversation → verify stream is found and raw bytes shown
• Open a TLS conversation → verify encrypted-stream notice is shown
• Open a conversation with gzip-encoded HTTP body → verify gzip decoded badge appears and body is readable
• Open a large session (>1 MB) → verify truncation warning appears
• Verify Packets tab still works normally after adding the tab UI

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a new session reconstruction feature that allows users to view reconstructed TCP/UDP streams and decoded application-layer payloads (such as HTTP) for specific conversations. While the implementation provides a useful new capability, the review identified several critical performance and correctness issues in the SessionReconstructionService. Specifically, the current approach of downloading entire PCAP files to temporary storage is inefficient, the HTTP message splitting logic is prone to false positives, the stream merging process suffers from $O(N^2)$ complexity, and the hex-to-byte conversion logic incorrectly handles odd-length strings.