It's not in general possible to "sniff" a twisted-pair Ethernet link without disrupting it, or at the very least it adds lots of unnecessary complication. All you want to is to test cables, so let's focus on that. But we can definitely add some bonus features: link discovery is not hard to implement and could be done without using an actual Ethernet PHY.
The scenario where you connect the tester to an unused/disconnect cable run is the baseline. At the minimum you'll want to protect the tester from electrostatic discharges and transients induced into the cable from neighboring mains circuits, or potentially even lightning. And you'll definitely want galvanic isolation at least matching that of the typical network equipment, and for that the best bet is to use what Ethernet nodes use: a 10/100BASE-TX transformer, also called "10/100BASE-TX magnetics".
The magnetics can be attached the RJ-45 jack on your board. Or you can get those two integrated together - transformer inside the jack - called, aptly, a magjack. The transformer isolation provides a potential (galvanic) barrier, but you still need ESD protection, and for that you'll want to look up Ethernet-specific ESD protection solutions, or design one yourself. An existing application circuit (from a datasheet/appnote for an Ethernet PHY) may be a good starting point, and you might end up using it as-is. This would be one example - ESD312 suppressors are used on the secondary side of the transformer, and LC03-3.3BTG suppressors are used on the primary side.
At this point, your device is isolated from DC potentials, so even if there was any PoE voltage present, nothing much will happen. Of course, you could detect PoE PSE (power sourcing equipment) if you wanted to. But that's optional.
The secondary sides of the magnetics (transformers), where a PHY would ordinarily attach, are center-tapped, so you can produce pulses of either polarity using a unipolar supply. That's enough to implement cable-testing functionality: you can transmit a waveform, and receive it, and you can also use an analog input on an MCU to measure the amplitude of that waveform. Since the Ethernet signals are DC-free, there's a minimum allowed frequency to use here in order not to saturate the magnetics. Typically, the magnetics specify the insertion loss from 100kHz up, and also specify their inductance at that frequency, so using a test frequency of 0.1MHz and up would be a good idea, although less may work too (e.g. 64kHz) with higher loss and at a lower maximum current. Of course you'd be terminating both the transmit and receive pairs, so you need to keep that in mind when looking at amplitudes: your driver won't be an ideal voltage source, and most MCU pins are inherently current-limited CMOS drivers and act like current sources.
Now, if you want to detect a link partner, look up the details about so-called link pulses in the various IEEE802 specs - those for 10BASE-TX, 100BASE-TX and 1000BASE-T, you can get an idea of the link partner detection and negotiation of capabilities. Your cable tester could, with probably nothing more than Arduino Mega or Zero, do link negotiation using the relatively slow link pulses, and provide information about the capabilities of the link partner. You could also detect a twin cable tester on the other end of the link, and provide extra capabilities that way - for one, you'd already use an established communications protocol (link autonegotation) that's designed specifically to allow extensibility. You could also detect modern PoE PSE (IEEE 802.3at), since it can be detected over that same digital channel.
To recap: you likely would want to implement a "bog standard" 100BASE-TX circuit up to where an Ethernet PHY would attach (be it a dedicated chip or one integrated in an MCU), and then decide on what to use for the PHY. With a bit of creativity you could probably make the cable testing and link detection/setup work using just the "raw" pins on an MCU, with no active external components, given that modern MCUs have reasonably strong pin drivers, analog inputs, and have timer functions plenty able to receive or transmit link pulses.
You could also use an MCU with a built-in Ethernet PHY, and just do normal link negotiation using that - then your cable tester could not only detect link partners, but could also do actual data transmission tests and detect error rates and such. Since you'd be likely limited to 100BASE-TX speeds that only use 2 out of the 4 pairs, to test all pairs you'd need to detect a twin cable tester of yours (they can be identical), re-negotiate the connection after two pairs are tested, and settle on using the other two pairs. For that, you could use a digital signal switch chip and effectively connect the PHY to the other two pairs. Note here that gigabit (1000BASE-T) magnetics support all 4 pairs for data transmission, while fast ethernet (100BASE-TX) magnetics support usually only two pairs and you would need two of them to use all 4 pairs.
On that note, to test all 4 pairs, you need either:
An RJ-45 jack and two discrete 100BASE-TX magnetics (transformers), or
A 1000BASE-T magjack, or
An RJ-45 jack and 1000BASE-T discrete magnetics.
Speaking of PoE, it wouldn't be a concern unless you wanted to detect the presence of a PSE (power sourcing equipment), or unless you were connecting to powered switch ports that use "legacy" or "dumb" power injection, i.e. not according to the IEEE802 standards. This is sometimes used for security cameras and other devices where due to cost considerations a compliant PD (powered device) implementation would not be feasible. For many such schemes, it's sufficient to use a simple "DVM front-end" without galvanic isolation (DVM stands for Digital VoltMeter). I.e. you'd use a resistor network and some protection components similar to those in digital multimeters to scale the differential voltage between any two center taps on the primary side of the magnetics and feed them to either a stand-alone differential ADC, or to the MCU, while taking care to ensure that the common-mode range on the A/D side is not exceeded. The easiest way to do it may be with reed relays or opto-mos switches, where GND (0V) and ADC-IN (scaled) would be attached to any two pair center-taps.
You'd want to use PoE magnetics or magjacks then, since those are designed to allow terminating all the signal pairs while allowing there to be a DC potential between pairs, and they also provide connections to the center taps of the transformer primaries - since PoE is "sent" down the wire as common-mode potential differences between pairs.
Conformant (i.e. standard) PoE is "inert" until the PSE detects a suitable PD, so if you detect no incoming power but a link partner is present, that would mean that if they are PSE then they are conformant, and then you could look for modern PSE through the autonegotiation channel, and perhaps fall-back to the 802.3af "simple resistor" PD indication. I don't recall offhand whether an 802.3af PSE needs to inform the link partner digitally about its capabilities - if it does, then you could basically forget about it until you get autonegotiation working and determine PSE only at that level. It also depends on how featureful you want your cable tester to be. It's not hard to have some resistors plugged into the circuit using opto-mos switches or similar, so pretending to be a simple PD is not hard.
