refactor: move Loki TUI from --watch to --report-only

[noexecstack]

Summary

• --watch + --from loki now errors with a message pointing to --report-only, since --watch implies live monitoring which only applies to hubble observe
• --report-only launches an interactive TUI (browse, scroll, select flows for policy generation) when on a terminal; falls back to plain text otherwise
• Fix Loki TUI black screen: the old --watch path re-parsed all flows on every refresh cycle, blocking the first frame render on large datasets; now parses once up front
• Add --since/--until validation to catch inverted Loki time windows (e.g. --since 5m --until 1h)
• Fix misleading docstring on _parse_flow_list that claimed flows must be pre-unwrapped
• Bump version to 0.16.0

Test plan

• All 144 existing tests pass
• Verify --watch works as before (live hubble)
• Verify --watch --from loki produces a clear error message
• Verify --report-only shows interactive TUI on a terminal
• Verify --report-only prints plain text in a non-TTY context (e.g. piped)
• Verify --from loki --report-only fetches and displays flows correctly
• Verify --since 5m --until 1h produces a validation error