feat: add interface traffic counters as fallback telemetry when conntrack flows unavailable

Add interface_traffic collection in agent to aggregate VM/LXC network counters by vmid/nic with tap/fwln/fwpr/fwbr interface ranking, implement collect_interface_traffic to select best interface per VM NIC and format as flow-like records with rx/tx bytes/packets, add collect_flow_diagnostics to capture conntrack binary path and kernel bridge/netfilter settings for debugging, update workload_insights endpoint

backend/app/api/v1/router.py

@@ -894,6 +894,32 @@ def workload_insights(workload_id: str, _: CurrentUser, db: Session = Depends(ge
                     "ip_addresses": [flow.source_ip, flow.destination_ip],
                 }
             )
+    if not traffic:
+        agent = db.get(NodeAgent, workload.node_id)
+        payload = agent.last_payload if agent and isinstance(agent.last_payload, dict) else {}
+        for item in payload.get("interface_traffic", []):
+            if not isinstance(item, dict) or str(item.get("vmid")) != str(workload.external_id):
+                continue
+            traffic.append(
+                {
+                    "source": workload.name,
+                    "destination": "network",
+                    "interface": item.get("interface"),
+                    "protocol": item.get("protocol") or "interface-counter",
+                    "port": None,
+                    "bytes": item.get("bytes") or 0,
+                    "packets": item.get("packets") or 0,
+                    "rx_bytes": item.get("rx_bytes") or 0,
+                    "tx_bytes": item.get("tx_bytes") or 0,
+                    "rx_packets": item.get("rx_packets") or 0,
+                    "tx_packets": item.get("tx_packets") or 0,
+                    "state": item.get("state") or "unknown",
+                    "decision": "observed",
+                    "observed_at": payload.get("collected_at"),
+                    "ip_addresses": workload_ips,
+                    "note": "Interface counter fallback. No host conntrack flows were available.",
+                }
+            )
     audit_mode_notes = [
         f"{policy.name} is in audit mode; matching traffic is logged without enforcement."
         for policy in policies