feat: Add HELP, CONFIG, FACTORY commands; sync project docs

Firmware: HELP lists all 27 commands with syntax, CONFIG dumps
running config as key=value, FACTORY erases NVS and reboots.

Docs: update PROJECT, ROADMAP, TASKS, TODO to reflect v1.10
completion, v1.11 unreleased work, and esp32-web v0.1.5 state.
Remove stale v2.0 Flask phase-by-phase plan (now tracked in
~/git/esp32-web/). Clean deferred items from completed milestones.

TASKS.md

@@ -1,50 +1,53 @@
 # ESP32 Hacking Tasks
 
-**Last Updated:** 2026-02-05
+**Last Updated:** 2026-02-14
 
-## Current Sprint: v2.0 — Flask API Backend
+## Firmware: Unreleased (v1.11 candidates)
 
-### P0 - Critical (Phase 1: Project Setup)
-- [ ] Create project scaffold `~/git/esp32-web/`
-- [ ] Flask app factory pattern with Blueprints
-- [ ] HTTP API on TCP 5500, UDP collector on UDP 5500
-- [ ] SQLAlchemy models: Sensor, Device, Sighting, Alert, Event, Probe
-- [ ] Containerfile for podman
-- [ ] Makefile (build, run, dev, stop, logs)
-- [ ] Basic pytest setup
+- [x] CSI ON/OFF command to toggle CSI collection
+- [x] HELP command (lists all 23 commands with syntax)
+- [x] FACTORY command (erase NVS config + reboot)
+- [x] CONFIG command (dump all running config key=value)
+- [ ] Tag and OTA deploy to fleet
 
-### P1 - High (Phase 2: UDP Collector)
-- [ ] UDP listener thread (parse CSI_DATA, BLE_DATA, PROBE_DATA, ALERT_DATA, EVENT)
-- [ ] Store parsed data to SQLite/PostgreSQL
-- [ ] Sensor heartbeat tracking (mark online/offline)
-- [ ] Integrate collector with Flask app lifecycle
+## Web Backend (`~/git/esp32-web/`)
 
-### P1 - High (Phase 3: Core API)
-- [ ] `GET /api/v1/sensors` — list sensors
-- [ ] `GET /api/v1/devices` — list devices (BLE + WiFi MACs)
-- [ ] `GET /api/v1/alerts` — alert feed with pagination
-- [ ] `GET /api/v1/probes` — probe requests
-- [ ] `GET /api/v1/events` — sensor events
-- [ ] `POST /api/v1/sensors/<id>/command` — send command to sensor
+Tracked separately in `~/git/esp32-web/TASKS.md`. Currently at v0.1.5.
 
-### P2 - Normal (Phase 4: OSINT)
-- [ ] MAC vendor lookup (OUI database)
-- [ ] BLE company_id mapping
-- [ ] `GET /api/v1/stats` — aggregate statistics
-- [ ] Export endpoints (CSV, JSON)
+## Firmware Backlog
 
-### P2 - Normal (Backlog from v1.x)
+### P1 - High
+- [ ] Test OTA rollback (flash bad firmware, verify auto-revert)
+
+### P2 - Normal
 - [ ] Tune presence threshold per room with real-world testing
 - [ ] Power consumption measurements using POWERTEST + external meter
-- [ ] Test OTA rollback (flash bad firmware, verify auto-revert)
+- [ ] PING command (echo reply for connectivity tests)
+- [ ] LOG command (runtime `esp_log_level_set()`)
+- [ ] Multi-target (send UDP to 2+ destinations)
 
 ### P3 - Low
 - [ ] Deep sleep mode with wake-on-CSI-motion
 - [ ] Battery-optimized duty cycling
+- [ ] Temp/heap alert thresholds (EVENT on overheat or low memory)
+- [ ] RSSI RESET command (reset min/max counters)
+- [ ] AP+STA config portal (captive portal for initial setup)
+
+### Documentation
 - [ ] Document esp-crab dual-antenna capabilities
 - [ ] Document esp-radar console features
 - [ ] Pin mapping for ESP32-DevKitC V1
 
+## Completed: v1.10 - LED Quiet Mode & CI Hardening
+
+- [x] LED quiet mode (off normally, solid on motion/presence, blinks on OTA)
+- [x] Default LED to quiet mode
+- [x] Build metadata in STATUS reply
+- [x] CI security checks (secrets scan, config validation)
+- [x] Firmware size check and version tag validation
+- [x] Size optimization (`-Os`, saves ~75KB)
+- [x] CSI ON/OFF toggle command
+
 ## Completed: v1.9 - Multi-Channel Scanning & BLE Fingerprinting
 
 - [x] CHANSCAN command (ON/OFF/NOW/INTERVAL)
@@ -212,10 +215,11 @@
 ## Notes
 
 - Adaptive threshold varies by environment; 0.001-0.01 is a good starting range
-- NVS keys (24 total): `send_rate`, `tx_power`, `adaptive`, `threshold`, `ble_scan`, `target_ip`, `target_port`, `hostname`, `boot_count`, `csi_mode`, `hybrid_n`, `auth_secret`, `flood_thresh`, `flood_window`, `scan_rate`, `probe_rate`, `powersave`, `presence`, `pr_thresh`, `bl_nsub`, `bl_amps`, `chanscan`, `chanscan_int`
+- NVS keys (26 total): `send_rate`, `tx_power`, `adaptive`, `threshold`, `ble_scan`, `target_ip`, `target_port`, `hostname`, `boot_count`, `csi_mode`, `hybrid_n`, `auth_secret`, `flood_thresh`, `flood_window`, `scan_rate`, `probe_rate`, `powersave`, `presence`, `pr_thresh`, `bl_nsub`, `bl_amps`, `chanscan`, `chanscan_int`, `led_quiet`, `csi_enabled`
+- UDP commands (23 total): STATUS, CONFIG, RATE, POWER, TARGET, HOSTNAME, CSI, CSIMODE, ADAPTIVE, THRESHOLD, BLE, SCANRATE, PROBERATE, CALIBRATE, PRESENCE, CHANSCAN, LED, POWERSAVE, AUTH, FLOODTHRESH, OTA, POWERTEST, PROFILE, IDENTIFY, REBOOT, FACTORY, HELP
 - EVENT packets include sensor hostname: `EVENT,<hostname>,motion=... rate=... wander=...`
 - ALERT_DATA format: `ALERT_DATA,<hostname>,<deauth|disassoc>,<sender_mac>,<target_mac>,<rssi>` or `ALERT_DATA,<hostname>,deauth_flood,<count>,<window_s>`
-- STATUS fields: `uptime=`, `uptime_s=`, `heap=`, `rssi=`, `channel=`, `tx_power=`, `rate=`, `csi_rate=`, `hostname=`, `version=`, `adaptive=`, `motion=`, `ble=`, `target=`, `temp=`, `csi_count=`, `boots=`, `rssi_min=`, `rssi_max=`, `csi_mode=`, `hybrid_n=`, `auth=`, `flood_thresh=`, `powersave=`, `presence=`, `pr_score=`
+- STATUS fields: `uptime=`, `uptime_s=`, `heap=`, `rssi=`, `channel=`, `tx_power=`, `rate=`, `csi_rate=`, `hostname=`, `version=`, `adaptive=`, `motion=`, `ble=`, `target=`, `temp=`, `csi_count=`, `boots=`, `rssi_min=`, `rssi_max=`, `csi=`, `csi_mode=`, `hybrid_n=`, `auth=`, `flood_thresh=`, `powersave=`, `presence=`, `pr_score=`, `chanscan=`, `led=`, `nvs_used=`, `nvs_free=`, `nvs_total=`, `part_size=`, `built=`, `idf=`, `chip=`
 - PROBE_DATA format: `PROBE_DATA,<hostname>,<mac>,<rssi>,<ssid>`
 - Probe requests deduped per MAC (default 10s cooldown, tunable via PROBERATE)
 - mDNS service: `_esp-csi._udp` on data port (for sensor discovery)