feat(#295): WiFi credentials to NVS, non-blocking connect, one-shot SD import

[Strycher]

Closes #147. Epic #99, child 1 of 4. Plan: docs/plans/2026-09-09-wifi-configuration.md (approved by the owner 2026-09-09, lands here).

What changed and why

Six placeholder credential literals sat in src/web.cpp since the #245 rebuild, so a main build could not join WiFi and every flash needed a local uncommitted edit. initWiFi() blocked setup() up to 22.5 s and checkWiFi() blocked loop() 5 s every 30 s while down, the stall #292 measured.

• src/wifi_store.{h,cpp} (new): saved networks in NVS via Preferences, namespace wifi, up to five in priority order, deduplicated by SSID, lowest slot replaced when full. Add / remove / move-up / clear for WiFi: /wifi web endpoint to list, add, delete, reorder, forget-all and handle the SD file (#99 child 2) #296 and WiFi: Settings sub-screen with scan list, LVGL keyboard, connect flow, forget-all (#99 child 3) #297. Writes go whole into the bank that is not live, then one key flips the live bank, so a power cut never leaves a half-written list (second gate pass). The layout the first bench build wrote is still read.
• One-shot SD import: /config/wifi.txt (the Settings: WiFi configuration with on-screen keyboard #99 format) is read at boot; entries are added to the store. The file is never modified or removed by this child: the owner is asked Remove or Keep by the screen (WiFi: Settings sub-screen with scan list, LVGL keyboard, connect flow, forget-all (#99 child 3) #297) and the web page (WiFi: /wifi web endpoint to list, add, delete, reorder, forget-all and handle the SD file (#99 child 2) #296), which call wifiImportFileRemove(). A repeat import is harmless. BOMs and trailing SSID whitespace are handled; a password is kept exactly, with a log line if it starts or ends with whitespace.
• src/web.cpp: the literals are gone. initWiFi() loads the store, imports, starts the first attempt and returns. checkWiFi() is a state machine IDLE / CONNECTING / CONNECTED / WAIT driven from loop(): 8 s per network, next network on rejection or absence, 30 s rest after all fail, restart from the top on a lost link, no delay() anywhere. NTP is started on connect and judged by sntp_get_sync_status() on later passes, never waited on. WiFi.persistent(false) so the core keeps no copy of the credentials; setAutoReconnect(false) so this machine is the only actor.
• CLAUDE.md: the credential note rewritten for the new provisioning path. Passwords are never logged and never leave the unit except into WiFi.begin().

Hardware

Flashed to the UM bench board at deac3d1 (before the two-bank store; the store rewrite and the legacy read are the only changes since, both build on both envs):

• Import of the owner's three networks from the SD file, "Setup complete!" printed before the connect finished, connected to the first network at RSSI -27 dBm, web server up, NTP synced.
• fieldcompass.local/json and /diags answered from the UM board for the first time; every peripheral OK on /diags.
• Not exercised: reconnect after an access-point drop. The integration test Epic #99 integration test: WiFi configuration on hardware #298 covers it.

Builds: um_feathers3 RAM 22.9% Flash 27.7%; feather_s3 RAM 31.8% Flash 64.9%.

Gemini gate (two passes, $0.06)

Fixed: crash-safe store writes (first pass: no clear() before rewrite; second pass: that was still not enough for shifted entries, hence the two banks); UTF-8 BOM at the start of any line; SSID whitespace trimmed, password whitespace kept and logged; NTP judged by the SNTP client rather than by the clock being sane (the RTC sets the clock at boot, so the old test would have claimed a sync on every boot and rewritten the RTC from itself).

Justified: NVS wear (wear-levelled, and NVS skips unchanged values); lost-link hysteresis (one attempt per 8 s at worst, then the 30 s rest); transient WiFi.status() values (bounded by the 8 s timeout); no symbol clash from esp_sntp.h; a stale COMPLETED status cannot carry across configTime(), which resets it.

Gap filed from the first bench boot

#299: the on-device Diagnostics sub-screen shows no WiFi status and cannot scroll. Child of #99, after this one.

🤖 Generated with Claude Code

[Strycher]

Agent: EmberDelta (session f0e32f9f)