security: WiFi credentials hardcoded in Field_Compass.ino — needs a provisioning mechanism

[Strycher]

_{Recreated from Strycher/Field_Compass-archive#147 — originally opened by @Strycher on 2026-08-09. Credentials redacted where present.}

Discovered while doing #146. Removing the credentials from docs/HARDWARE.md addressed the documentation copy only — the same three SSID/password pairs are hardcoded in firmware source:

Field_Compass/Field_Compass.ino:95-100 — WIFI_SSID_1..3 / WIFI_PASS_1..3 as const char* string literals.

This is the more significant exposure: the values are in tracked source, in every release build's flash image, and in git history.

Also minor: .claude/settings.local.json:29 embeds one SSID inside an old archived commit-message permission string. No password. Worth cleaning in the same pass.

Why this is not a quick fix

It needs a provisioning design decision, and it touches firmware — so it requires a compile plus hardware verification per CLAUDE.md § Branch Strategy. Options, roughly in increasing order of effort:

1. Gitignored header — Field_Compass/wifi_credentials.h, #included by the sketch, with a committed wifi_credentials.h.example. Smallest change; keeps compile-time provisioning. Breaks a fresh clone's build until the file is created.
2. Compile-time defines — pass via arduino-cli compile --build-property. No secret files at all, but the build command grows and CI needs the values injected.
3. Runtime provisioning from SD — read /config/wifi.txt at boot, matching the existing /config/mag_cal.txt pattern. Most flexible, no rebuild to change networks, and it is the natural precursor to Settings: WiFi configuration with on-screen keyboard #99 (on-screen WiFi configuration). Largest change.

Recommendation: option 3, because #99 is already open and wants runtime WiFi config anyway — options 1 and 2 would be thrown away when #99 lands. But this is a design call for the owner, not the agent.

Accepted risk (carried from #146)

Credentials stay in git history. The owner declined WiFi rotation on 2026-08-08 and accepts the risk. This issue is about stopping the leak going forward, not purging the past.

Acceptance criteria

• No SSID or password literal in any tracked file, Field_Compass.ino included
• Firmware compiles: arduino-cli compile --fqbn esp32:esp32:adafruit_feather_esp32s3 Field_Compass/
• Human flashes and confirms the device still associates with the home AP

[Strycher]

_{@github-actions[bot] — 2026-08-09}

🤖 Auto-promoted to Ready — all dependencies resolved (#146 closed).

[Strycher]

_{@github-actions[bot] — 2026-08-09}

🤖 Auto-promoted to Ready — all dependencies resolved (#146 closed).

[Strycher]

_{@github-actions[bot] — 2026-08-09}

🤖 Auto-promoted to Ready — all dependencies resolved (#146 closed).

[Strycher]

Folded into epic #99 as child 1 (#295) by the owner's decision 2026-09-09. Closed by that child's PR.