network: traffic, its busiest processes and the IPs on the page

The rx/tx graph, the LAN address and the public IP with its pin move from
the perf page's NET card to the network page, where they belong; the NET
card is gone. Perf still samples and owns all of them: the graph opens on
the last minute of history, and a public IP that differs from the pin
still lights the perf tile's dot.

Below the graph, the five busiest processes. nethogs is installed but
cannot open any interface unprivileged, so the rates come from
`ss -tinpH`: per-socket byte counters diffed every 2s while the page is
open, summed by process name. That counts TCP only, and only the user's
own processes, so QUIC and system services are missing. The list is held
at five rows tall so the IP lines under it never move.

Perf.js gains sockets() and netProcs(), with tests in test_perf.js.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 1 deletions

diff --git a/desktop/modules/network/README.md b/desktop/modules/network/README.md
index a806488..551e23c 100644
--- a/desktop/modules/network/README.md
+++ b/desktop/modules/network/README.md
@@ -10,7 +10,17 @@ slow timer while a link is up. When both wired and wifi are up the tile shows
 both: the API exposes no route metric, so it does not guess which link
 carries traffic.
 
-The page lists managed wired devices, then a wifi radio switch and list. A
+The page opens on traffic: `br0`'s download and upload over the last minute,
+sampled always by `perf/Perf.qml`, the five busiest processes below it, then
+the LAN address and the public IP with its pin (see the perf README; Perf
+still owns both, since a mismatch lights the perf tile's dot).
+Those come from `ss -tinp`, its per-socket byte counters diffed every 2s
+while the page is open, summed by process name. That is TCP only and the
+user's own processes only: QUIC and system services are missing. nethogs
+would see both, but unprivileged it cannot open the interfaces. The parsing
+is in `perf/Perf.js`, tested by `perf/test_perf.js`.
+
+Then the page lists managed wired devices, then a wifi radio switch and list. A
 row click connects; a secured network that is not yet known reveals an inline
 password field. Known networks offer Forget, the connected one Disconnect.