feat(firmware): M2 WiFi + on-device REST API

Adds the WiFi-to-app sync path and the on-device open REST API implementing the
device paths of api/openapi.yaml, plus persistent config in NVS.

What changed:
- firmware/src/config.{h,cpp}: NVS (Preferences) store - stable device id from MAC,
  WiFi SSID/PSK, API bearer token, upload settings. Secrets stay off the SD card.
- firmware/src/net_wifi.{h,cpp}: station join with stored creds; SoftAP provisioning
  fallback when no creds / join fails; mDNS openscribe.local; reconnect in loop().
- firmware/src/api_http.{h,cpp}: synchronous WebServer on :80. Routes: GET /device,
  GET/PUT /device/config, GET /recordings, GET /recordings/{id}, GET
  /recordings/{id}/audio (HTTP Range -> 206 + Content-Range), DELETE /recordings/{id},
  POST /record/start|stop. Bearer-token auth on mutating calls (open when no token).
- firmware/src/storage.{h,cpp}: list/read/delete/count helpers + path builders.
- firmware/src/main.cpp: wire config + WiFi + API into setup/loop; bump fw to 0.2.0.
- firmware/platformio.ini: add bblanchon/ArduinoJson@^7 (only new dep).
- state/: ARCHITECTURE, NOTES, TODO updated; security + NTP follow-ups recorded.

Why:
- This is the WiFi transfer channel and the device half of the "completely open API":
  clients can list, download (resumable), delete and control without any cloud.

Notes:
- Not compiled locally (no PlatformIO on the dev host) or hardware-verified; CI builds
  both board profiles. Security follow-ups logged: API is open when no token is set,
  and the SoftAP uses a fixed default passphrase (make user-set at M4/BLE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

state/ARCHITECTURE.md

@@ -39,9 +39,9 @@ Three sync paths, exactly as specified:
   - `recorder` - session state machine (idle/recording), file naming, metadata. [M1]
   - `ux`     - button (short-press start/stop) + status LED (haptic later). [M1]
   - `power`  - battery read (ADC), charge/VBUS detect -> mode switch.
-  - `config` - NVS-stored settings (WiFi creds, upload target + keys, codec).
-  - `net_wifi` - WiFi manager (join, reconnect), mDNS.
-  - `api_http` - on-device REST server (see `api/openapi.yaml`).
+  - `config` - NVS-stored settings (device id, WiFi creds, api token, upload). [M2]
+  - `net_wifi` - WiFi station join/reconnect + SoftAP provisioning fallback + mDNS. [M2]
+  - `api_http` - on-device REST server implementing the device paths. [M2]
   - `uploader` - S3-compatible / WebDAV client; pushes audio + metadata when powered.
   - `ble`    - GATT: device info, battery, record control, WiFi provisioning, status.
   - `ota`    - firmware update over HTTP.

state/NOTES.md

@@ -52,6 +52,27 @@ Per component (see each component's README for detail):
   then. See the follow-ups in TODO.md.
 - Not yet compiled locally (no PlatformIO on the dev host) - CI builds both profiles.
 
+## Firmware specifics (M2)
+
+- REST API served by the core-bundled synchronous `WebServer` on port 80. Path params via
+  `server.on("/.../{}" , ...)` + `server.pathArg(0)`. `collectHeaders` is required to read
+  `Authorization` and `Range`. Register `/recordings/{}/audio` before `/recordings/{}`.
+- Audio download implements HTTP Range (206 + Content-Range) by seeking the file and
+  streaming with `sendContent`; full GET sends `Accept-Ranges: bytes`.
+- Only new dep is `bblanchon/ArduinoJson@^7` (request parse + JSON responses). WiFi,
+  WebServer, ESPmDNS, Preferences, SD are all core-bundled.
+- WiFi: station mode with stored creds; on no-creds/failure it opens a SoftAP
+  `OpenScribe-<macsuffix>` (pass `openscribe`) so the API is reachable to provision WiFi.
+  mDNS name is `openscribe.local`.
+- Config/secrets live in NVS (`Preferences` namespace `openscribe`), never on the SD card.
+
+## Security follow-ups (before any real deployment)
+
+- API auth is open when no token is set (convenient on a trusted LAN). Set an `api_token`
+  via `PUT /device/config` to require `Authorization: Bearer` on mutating calls; consider
+  requiring it for reads too. Tracked in TODO.
+- SoftAP uses a fixed default passphrase; make it user-set during provisioning (M4/BLE).
+
 ## Dead ends
 
 - (none yet)

state/TODO.md

@@ -5,15 +5,14 @@
 
 ## In progress
 
-- [ ] (nothing active - M2 is next)
+- [ ] M2 On-device WiFi + REST API - code complete on `feature/fw-rest-api`, in PR.
+      Not compiled locally / hardware-verified; CI builds both profiles.
 
 ## Pending (roughly in build order)
 
-- [ ] M2 On-device WiFi + REST API: WiFi manager, mDNS, list/get/download(range)/delete
-      recordings, device status. Implements `api/openapi.yaml` device paths.
-      (branch `feature/fw-rest-api`)
-- [ ] M3 Independent uploader: NVS config store, charge/VBUS detect -> powered mode,
-      S3-compatible + WebDAV upload of audio + metadata. (branch `feature/fw-uploader`)
+- [ ] M3 Independent uploader: charge/VBUS detect -> powered mode, S3-compatible +
+      WebDAV upload of audio + metadata (config store already landed in M2).
+      (branch `feature/fw-uploader`)
 - [ ] M4 BLE GATT: device info, battery, record control, WiFi provisioning, status
       notifications; hand-off to WiFi for transfer. (branch `feature/fw-ble`)
 - [ ] M5 Server ingest + transcription: FastAPI ingest from object store/upload, store,
@@ -31,6 +30,9 @@
 
 ## Done
 
+- [x] M2 On-device WiFi + REST API - WiFi/SoftAP + mDNS + config(NVS) + device REST API
+      (status, list, metadata, audio-with-Range, delete, record start/stop, config).
+      (PR #2 `feature/fw-rest-api`, 2026-07-03). Not yet hardware-verified.
 - [x] M1 Firmware recording core - mic capture to WAV on SD + button/LED + metadata
       (merged: PR #1 `feature/fw-recorder-core`, 2026-07-03). Not yet hardware-verified.
 - [x] M0 Scaffold - repo, licences, state docs, BOM, OpenAPI, skeletons, CI
@@ -44,8 +46,10 @@
 - [ ] Audio calibration: INMP441 emits 24-bit samples in a 32-bit slot. M1 reads in
       16-bit mode (usable for speech, may be quiet). If levels are low on the dev build,
       capture 32-bit and right-shift into int16 in `audio.cpp`.
-- [ ] Real timestamps: M1 ids/`started_at` are uptime-based (no RTC/NTP yet). M2 adds NTP
-      over WiFi; switch ids and `started_at` to real UTC then.
+- [ ] Real timestamps: ids/`started_at` are uptime-based (no RTC/NTP yet). Add NTP now
+      that WiFi exists (M2), and switch ids and `started_at` to real UTC.
+- [ ] API auth is open when no token set; SoftAP has a fixed default passphrase. Harden
+      both before any deployment (see NOTES "Security follow-ups").
 
 ## Blocked / waiting