[AlyaGomaa]

Sub-PR of #2141: part 4 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• --list-instances, --stop [PID|all] and --restart: find verified Slips runs of this checkout, recheck script, PID and creation time before SIGTERM, wait for cleanup, never force-kill (instance_control.py).
• --web-port selects the web interface port; --keep-history keeps previous detections and flows on a live capture.
• Bounded shutdown: owned Zeek and worker processes are tracked and cleaned after Ctrl-C (owned_processes.py), shutdown notifications have a deadline, unread queues are released.
• Daemon: native startup fix, multiprocessing state preserved, --stop is the single stop option.
• A PCAP analysis can run beside a retained live capture with its own Redis port, output and persistent directories (analysis_config.py, redis_manager.py).
• Redis PID files are writable and per instance.

Where it sits in the split

• Chain: part 4 of 12. Review and merge in order.
• Base: sebas/feat/persistent_host_identity (Persist host identity across runs and networks #2200), so the diff shows only this PR's changes. GitHub retargets it to develop when Persist host identity across runs and networks #2200 merges.
• Next: Add scoped whitelist rules and macOS blocking #2202.
• Size: 37 files, +4890 / -434 lines (tests are +2710 of them).
• Built from parent head 8d6533186.

Notes for review

• --view (reopen a saved run) is in the web sub-PR because it needs the new web server.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 3983 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.