Initial commit: NetworkCity — network traffic as a neon city

A native macOS network monitor that renders live traffic as a top-down
neon city: your Mac is downtown, remote orgs are glowing districts, and
traffic is cars of light driving the roads.

Architecture:
- NetworkCityCore: swappable data layer behind a ConnectionSource protocol
  (nettop-backed today), plus pure/tested logic — traffic diffing, org
  classification (reverse-DNS + CIDR), traffic classes, hub-and-spoke
  expansion policy, label anti-overlap, and latency→distance layout.
- NetworkCityApp: SwiftUI + SpriteKit city — auto-expanding districts,
  protocol-coloured cars, click-to-inspect panel, and latency-as-distance
  (districts glide to their measured RTT).
- nettop-probe: CLI proof of the data layer.

44 tests passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Tests/NetworkCityCoreTests/IPRangesTests.swift

@@ -0,0 +1,42 @@
+import XCTest
+@testable import NetworkCityCore
+
+final class IPRangesTests: XCTestCase {
+
+    func testAppleEightSlashEight() {
+        XCTAssertEqual(IPRanges.match("17.248.242.19")?.key, "apple")
+        XCTAssertEqual(IPRanges.match("17.42.251.69")?.name, "Apple")
+    }
+
+    func testTelegram() {
+        XCTAssertEqual(IPRanges.match("149.154.175.54")?.key, "telegram")
+    }
+
+    func testPrivateRangesAreLocalNetwork() {
+        XCTAssertEqual(IPRanges.match("192.168.0.1")?.name, "Local Network")
+        XCTAssertEqual(IPRanges.match("10.1.2.3")?.key, "lan")
+        XCTAssertEqual(IPRanges.match("172.20.0.5")?.key, "lan")
+    }
+
+    func testUnknownIPReturnsNil() {
+        XCTAssertNil(IPRanges.match("8.8.8.8"))
+    }
+
+    func testInvalidIPReturnsNil() {
+        XCTAssertNil(IPRanges.match("not.an.ip"))
+        XCTAssertNil(IPRanges.match("999.1.1.1"))
+    }
+
+    func testClassifyUsesRangeFallbackWhenNoPTR() {
+        // Apple publishes no PTR for 17/8, so the range table must catch it.
+        let org = OrgClassifier.classify(ip: "17.248.242.19", ptr: nil)
+        XCTAssertEqual(org.key, "apple")
+        XCTAssertEqual(org.name, "Apple")
+    }
+
+    func testPTRStillWinsOverRange() {
+        // A real registrable domain in the PTR should take precedence.
+        let org = OrgClassifier.classify(ip: "17.248.242.19", ptr: "host.example.com")
+        XCTAssertEqual(org.key, "example.com")
+    }
+}