feat: add `--setup-only` and `--no-setup` CLI flags

for better security we might want to run setup (nfq, epehemeral ports, routes, etc) only once with elevated privileges, and then run proxy as unprivileged user.

Start by locating the Rust CLI argument parsing and the routines that configure nfq, ephemeral ports, and routes. Define how --setup-only performs setup and exits, and how --no-setup skips it so the proxy can run unprivileged; done means both flags work without disrupting the existing setup path.

Written by the indexing model from the issue text.