Audit what the network exposes to the internet

[gclluch]

netdiff could say what changed on the network but not whether any of it was reachable from outside the house. netdiff audit <subnet> answers that.

• Enumerates the router's UPnP port-forwarding table (SSDP → IGD description → SOAP GetGenericPortMappingEntry) and cross-references each forward against the devices actually present, so a finding names the device rather than an address.
• Flags the case nothing else surfaces: a forward pointing at an address no device currently holds, which DHCP will hand to something else.
• Every finding carries its evidence, why it matters, how to fix it, and a command you run yourself to confirm it. --explain <rule> reads any lesson without scanning.
• Findings are persisted per scan, so a repeat audit marks what is [NEW].

Three invariants hold the design up: rules are pure functions that open no sockets, Finding.evidence has no default so a finding cannot be built without its receipt, and the audit is read-only - no credentials, no writes, only GetGenericPortMappingEntry and deliberately no AddPortMapping path.

An open port is reported as info and explicitly labelled not a problem. A port number is not treated as evidence of a protocol either: services that greet unprompted must be heard before they are named.

Still zero dependencies and Python 3.9+. 88 tests, roughly half of test_audit.py asserting that something is not reported.