Write captures under CAPTURE_DIR (default /tmp) instead of the working directory

[turner-moore]

Problem

All four capture tools (capture_packets, capture_summary, capture_conversations, and the threat-check capture) hardcode the temp file as temp_capture.pcap in the process's current working directory:

const tempPcap = 'temp_capture.pcap';

Writing into the cwd has three downsides:

• It fails when the server runs from a read-only working directory.
• It clutters whatever directory the server happens to be launched from.
• Two captures running from the same cwd collide on the same filename.

Fix

Route the temp pcap through a CAPTURE_DIR environment variable, defaulting to /tmp (the conventional place for scratch files):

const tempPcap = `${process.env.CAPTURE_DIR || '/tmp'}/temp_capture.pcap`;

Compatibility

Behavior changes only in that the scratch file now lands in /tmp by default instead of the cwd. The file is temporary and deleted after processing, so nothing downstream depends on its location. Anyone who wants the old location can set CAPTURE_DIR=..