Add LAN-broadcast lockdown, per-rotation MAC, leak audit panel

Tier-1 paranoid hardening: privacy_lan.py disables LLMNR/NetBIOS/mDNS with reversible snapshot; service rotates MAC on every chain rotation when enabled; leak_audit.py probes every leak surface (IP, DNS, IPv6, WPAD, GPO, ProxySettingsPerUser, LAN broadcast, VPN, WebRTC) and renders pass/fail in Privacy tab.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_proxy_god.py

@@ -217,5 +217,64 @@ class TestValidator(unittest.TestCase):
         self.assertIsNone(asyncio.run(run()))
 
 
+class TestPrivacyLan(unittest.TestCase):
+    def test_snapshot_round_trip(self) -> None:
+        from proxy_chain_manager.privacy_lan import (
+            LanSnapshot, snapshot_from_json, snapshot_to_json,
+        )
+        s = LanSnapshot(
+            netbios_per_interface={"{a-b-c}": 0, "{d-e-f}": 2},
+            llmnr_present=True,
+            llmnr_prev_value=1,
+            mdns_present=False,
+            mdns_prev_value=None,
+        )
+        round_tripped = snapshot_from_json(snapshot_to_json(s))
+        self.assertIsNotNone(round_tripped)
+        assert round_tripped is not None
+        self.assertEqual(round_tripped.netbios_per_interface, s.netbios_per_interface)
+        self.assertEqual(round_tripped.llmnr_present, s.llmnr_present)
+        self.assertEqual(round_tripped.llmnr_prev_value, s.llmnr_prev_value)
+        self.assertEqual(round_tripped.mdns_present, s.mdns_present)
+        self.assertEqual(round_tripped.mdns_prev_value, s.mdns_prev_value)
+
+    def test_lan_status_returns_keys(self) -> None:
+        from proxy_chain_manager.privacy_lan import lan_status
+        st = lan_status()
+        self.assertIn("netbios", st)
+        self.assertIn("llmnr", st)
+        self.assertIn("mdns", st)
+
+
+class TestLeakAuditPure(unittest.TestCase):
+    def test_categorize_exit_private(self) -> None:
+        from proxy_chain_manager.leak_audit import _categorize_exit
+        self.assertEqual(_categorize_exit("10.0.0.5"), "PRIVATE — chain broken")
+        self.assertEqual(_categorize_exit("192.168.1.1"), "PRIVATE — chain broken")
+        self.assertEqual(_categorize_exit("172.20.5.5"), "PRIVATE — chain broken")
+
+    def test_categorize_exit_loopback(self) -> None:
+        from proxy_chain_manager.leak_audit import _categorize_exit
+        self.assertEqual(_categorize_exit("127.0.0.1"), "LOOPBACK — chain broken")
+
+    def test_categorize_exit_public(self) -> None:
+        from proxy_chain_manager.leak_audit import _categorize_exit
+        self.assertEqual(_categorize_exit("104.28.3.99"), "public")
+        self.assertEqual(_categorize_exit("8.8.8.8"), "public")
+
+    def test_categorize_exit_none(self) -> None:
+        from proxy_chain_manager.leak_audit import _categorize_exit
+        self.assertEqual(_categorize_exit(None), "unknown")
+
+    def test_audit_finding_aggregation(self) -> None:
+        from proxy_chain_manager.leak_audit import AuditReport
+        rep = AuditReport()
+        rep.add("X", True, "ok")
+        self.assertTrue(rep.overall_ok)
+        rep.add("Y", False, "bad", "note")
+        self.assertFalse(rep.overall_ok)
+        self.assertEqual(len(rep.findings), 2)
+
+
 if __name__ == "__main__":
     unittest.main()