network: NIC spoof matching tunnel (#912)

## Link to GitHub Issue or related Pull Request, if one exists
#911

## Description of change
Add tunnelhost/tunnelclient modes to -nicspoof so two cabs can do
LAN-style BPL matching over a real UDP path (including Wine), while
keeping the fake overlay NIC. Offline spoof remains available as before.

## Testing
DDR

src/spice2x/hooks/nicspoof.h

@@ -1,3 +1,28 @@
 #pragma once
 
+#include <cstdint>
+#include <string>
+
+enum class NicSpoofMode {
+    Off,
+    Offline,
+    TunnelHost,
+    TunnelClient,
+};
+
+struct NicSpoofConfig {
+    NicSpoofMode mode = NicSpoofMode::Off;
+    uint32_t local_ip = 0x0A64640Au; /* 10.100.100.10 */
+    uint16_t tunnel_port = 51820;
+    std::string hub_host;
+};
+
+void nicspoof_configure(const NicSpoofConfig &cfg);
 void nicspoof_init();
+
+/*! True when mode is TunnelHost or TunnelClient (divert hooks own ws2 sendto/etc.). */
+bool nicspoof_tunnel_enabled();
+
+uint32_t nicspoof_local_ip();
+uint32_t nicspoof_mask();
+uint32_t nicspoof_subnet();