feat(firmware): M2 WiFi + on-device REST API

Adds the WiFi-to-app sync path and the on-device open REST API implementing the
device paths of api/openapi.yaml, plus persistent config in NVS.

What changed:
- firmware/src/config.{h,cpp}: NVS (Preferences) store - stable device id from MAC,
  WiFi SSID/PSK, API bearer token, upload settings. Secrets stay off the SD card.
- firmware/src/net_wifi.{h,cpp}: station join with stored creds; SoftAP provisioning
  fallback when no creds / join fails; mDNS openscribe.local; reconnect in loop().
- firmware/src/api_http.{h,cpp}: synchronous WebServer on :80. Routes: GET /device,
  GET/PUT /device/config, GET /recordings, GET /recordings/{id}, GET
  /recordings/{id}/audio (HTTP Range -> 206 + Content-Range), DELETE /recordings/{id},
  POST /record/start|stop. Bearer-token auth on mutating calls (open when no token).
- firmware/src/storage.{h,cpp}: list/read/delete/count helpers + path builders.
- firmware/src/main.cpp: wire config + WiFi + API into setup/loop; bump fw to 0.2.0.
- firmware/platformio.ini: add bblanchon/ArduinoJson@^7 (only new dep).
- state/: ARCHITECTURE, NOTES, TODO updated; security + NTP follow-ups recorded.

Why:
- This is the WiFi transfer channel and the device half of the "completely open API":
  clients can list, download (resumable), delete and control without any cloud.

Notes:
- Not compiled locally (no PlatformIO on the dev host) or hardware-verified; CI builds
  both board profiles. Security follow-ups logged: API is open when no token is set,
  and the SoftAP uses a fixed default passphrase (make user-set at M4/BLE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

state/TODO.md

@@ -5,15 +5,14 @@
 
 ## In progress
 
-- [ ] (nothing active - M2 is next)
+- [ ] M2 On-device WiFi + REST API - code complete on `feature/fw-rest-api`, in PR.
+      Not compiled locally / hardware-verified; CI builds both profiles.
 
 ## Pending (roughly in build order)
 
-- [ ] M2 On-device WiFi + REST API: WiFi manager, mDNS, list/get/download(range)/delete
-      recordings, device status. Implements `api/openapi.yaml` device paths.
-      (branch `feature/fw-rest-api`)
-- [ ] M3 Independent uploader: NVS config store, charge/VBUS detect -> powered mode,
-      S3-compatible + WebDAV upload of audio + metadata. (branch `feature/fw-uploader`)
+- [ ] M3 Independent uploader: charge/VBUS detect -> powered mode, S3-compatible +
+      WebDAV upload of audio + metadata (config store already landed in M2).
+      (branch `feature/fw-uploader`)
 - [ ] M4 BLE GATT: device info, battery, record control, WiFi provisioning, status
       notifications; hand-off to WiFi for transfer. (branch `feature/fw-ble`)
 - [ ] M5 Server ingest + transcription: FastAPI ingest from object store/upload, store,
@@ -31,6 +30,9 @@
 
 ## Done
 
+- [x] M2 On-device WiFi + REST API - WiFi/SoftAP + mDNS + config(NVS) + device REST API
+      (status, list, metadata, audio-with-Range, delete, record start/stop, config).
+      (PR #2 `feature/fw-rest-api`, 2026-07-03). Not yet hardware-verified.
 - [x] M1 Firmware recording core - mic capture to WAV on SD + button/LED + metadata
       (merged: PR #1 `feature/fw-recorder-core`, 2026-07-03). Not yet hardware-verified.
 - [x] M0 Scaffold - repo, licences, state docs, BOM, OpenAPI, skeletons, CI
@@ -44,8 +46,10 @@
 - [ ] Audio calibration: INMP441 emits 24-bit samples in a 32-bit slot. M1 reads in
       16-bit mode (usable for speech, may be quiet). If levels are low on the dev build,
       capture 32-bit and right-shift into int16 in `audio.cpp`.
-- [ ] Real timestamps: M1 ids/`started_at` are uptime-based (no RTC/NTP yet). M2 adds NTP
-      over WiFi; switch ids and `started_at` to real UTC then.
+- [ ] Real timestamps: ids/`started_at` are uptime-based (no RTC/NTP yet). Add NTP now
+      that WiFi exists (M2), and switch ids and `started_at` to real UTC.
+- [ ] API auth is open when no token set; SoftAP has a fixed default passphrase. Harden
+      both before any deployment (see NOTES "Security follow-ups").
 
 ## Blocked / waiting