netcfg: standalone conntrack node (stats + list)

New paths under /scheme/netcfg/conntrack/:
  stats → per-protocol breakdown (tcp/udp/icmp + per-state)
  list  → full connection listing with TCP state

Previously conntrack data was only accessible via netfilter scheme
(/scheme/netfilter/conntrack/*). Now available directly through
the main netcfg monitoring interface.

Output matches the netfilter nodes exactly (same format/stats methods).

All 31 tests pass.

netstack/src/scheme/netcfg/mod.rs

@@ -147,6 +147,28 @@ fn mk_root_node(
                 out
             }
         },
+        "conntrack" => {
+            "stats" => {
+                ro [filter_table] || {
+                    let table = filter_table.borrow();
+                    if let Some(ref ct) = table.conntrack {
+                        ct.stats()
+                    } else {
+                        "conntrack: not enabled\n".to_string()
+                    }
+                }
+            },
+            "list" => {
+                ro [filter_table] || {
+                    let table = filter_table.borrow();
+                    if let Some(ref ct) = table.conntrack {
+                        ct.format()
+                    } else {
+                        "conntrack: not enabled\n".to_string()
+                    }
+                }
+            },
+        },
         "capture" => {
             "enable" => {
                 wo [observer] (Option<()>, None)