feat(firmware): M2 WiFi + on-device REST API

Adds the WiFi-to-app sync path and the on-device open REST API implementing the
device paths of api/openapi.yaml, plus persistent config in NVS.

What changed:
- firmware/src/config.{h,cpp}: NVS (Preferences) store - stable device id from MAC,
  WiFi SSID/PSK, API bearer token, upload settings. Secrets stay off the SD card.
- firmware/src/net_wifi.{h,cpp}: station join with stored creds; SoftAP provisioning
  fallback when no creds / join fails; mDNS openscribe.local; reconnect in loop().
- firmware/src/api_http.{h,cpp}: synchronous WebServer on :80. Routes: GET /device,
  GET/PUT /device/config, GET /recordings, GET /recordings/{id}, GET
  /recordings/{id}/audio (HTTP Range -> 206 + Content-Range), DELETE /recordings/{id},
  POST /record/start|stop. Bearer-token auth on mutating calls (open when no token).
- firmware/src/storage.{h,cpp}: list/read/delete/count helpers + path builders.
- firmware/src/main.cpp: wire config + WiFi + API into setup/loop; bump fw to 0.2.0.
- firmware/platformio.ini: add bblanchon/ArduinoJson@^7 (only new dep).
- state/: ARCHITECTURE, NOTES, TODO updated; security + NTP follow-ups recorded.

Why:
- This is the WiFi transfer channel and the device half of the "completely open API":
  clients can list, download (resumable), delete and control without any cloud.

Notes:
- Not compiled locally (no PlatformIO on the dev host) or hardware-verified; CI builds
  both board profiles. Security follow-ups logged: API is open when no token is set,
  and the SoftAP uses a fixed default passphrase (make user-set at M4/BLE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

firmware/src/net_wifi.cpp

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-3.0-only
+#include "net_wifi.h"
+
+#include <ESPmDNS.h>
+#include <WiFi.h>
+
+#include "config.h"
+
+namespace {
+bool apMode = false;
+uint32_t lastReconnect = 0;
+
+void startMdns() {
+  // openscribe.local -> device; advertise the HTTP API service.
+  if (MDNS.begin("openscribe")) {
+    MDNS.addService("http", "tcp", 80);
+  }
+}
+}  // namespace
+
+namespace net_wifi {
+
+bool begin() {
+  const String ssid = config::wifiSsid();
+
+  if (!ssid.isEmpty()) {
+    WiFi.mode(WIFI_STA);
+    WiFi.setSleep(false);
+    WiFi.begin(ssid.c_str(), config::wifiPsk().c_str());
+    const uint32_t t0 = millis();
+    while (WiFi.status() != WL_CONNECTED && (millis() - t0) < 15000) {
+      delay(200);
+    }
+  }
+
+  if (WiFi.status() != WL_CONNECTED) {
+    // Provisioning fallback: open a SoftAP so a client can reach the API and set WiFi.
+    apMode = true;
+    WiFi.mode(WIFI_AP);
+    String ap = "OpenScribe-" + config::deviceId().substring(11);  // MAC suffix
+    // WPA2 needs an 8+ char passphrase; note in TODO to make this user-set (M4).
+    WiFi.softAP(ap.c_str(), "openscribe");
+  }
+
+  startMdns();
+  return true;
+}
+
+void loop() {
+  if (apMode) return;
+  if (WiFi.status() != WL_CONNECTED && (millis() - lastReconnect) > 10000) {
+    lastReconnect = millis();
+    WiFi.reconnect();
+  }
+}
+
+bool connected() { return WiFi.status() == WL_CONNECTED; }
+bool isAccessPoint() { return apMode; }
+String ip() {
+  return apMode ? WiFi.softAPIP().toString() : WiFi.localIP().toString();
+}
+
+}  // namespace net_wifi