feat: Add baseline calibration & presence detection (v1.7)

CALIBRATE command captures per-subcarrier CSI amplitudes over a timed
window and stores the averaged baseline in NVS. PRESENCE command enables
real-time scoring via normalized Euclidean distance against the baseline,
with rolling window averaging and 10s holdoff on state transitions.

New commands: CALIBRATE [3-60|STATUS|CLEAR], PRESENCE [ON|OFF|THRESHOLD]
New NVS keys: bl_amps (blob), bl_nsub, presence, pr_thresh
New STATUS fields: presence=, pr_score=
New events: calibrate=done, presence=0|1

docs/CHEATSHEET.md

@@ -55,6 +55,14 @@ esp-cmd <host> AUTH mysecret123         # Enable HMAC auth (8-64 char secret)
 esp-cmd <host> AUTH OFF                 # Disable auth
 esp-cmd <host> FLOODTHRESH             # Query deauth flood threshold (5/10s)
 esp-cmd <host> FLOODTHRESH 10 30       # Set: 10 deauths in 30s = flood
+esp-cmd <host> CALIBRATE                # Start baseline capture (default 10s, room must be empty)
+esp-cmd <host> CALIBRATE 20            # Calibrate for 20 seconds
+esp-cmd <host> CALIBRATE STATUS        # Show baseline info (valid/invalid, nsub)
+esp-cmd <host> CALIBRATE CLEAR         # Delete baseline, disable presence
+esp-cmd <host> PRESENCE                # Query: on/off, baseline, threshold, score
+esp-cmd <host> PRESENCE ON             # Enable presence detection (needs baseline)
+esp-cmd <host> PRESENCE OFF            # Disable presence detection
+esp-cmd <host> PRESENCE THRESHOLD 0.08 # Set presence threshold (0.001-1.0)
 esp-cmd <host> REBOOT                   # Restart device
 ```
 
@@ -142,6 +150,38 @@ esp-cmd amber-maple.local THRESHOLD 0.005  # Tune sensitivity
 # Good starting range: 0.001 - 0.01
 ```
 
+## Presence Detection
+
+CSI-based presence detection compares live per-subcarrier amplitudes against
+a baseline captured with the room empty.
+
+### Setup
+
+```bash
+# 1. Ensure room is empty, CSI is flowing (200+ packets)
+esp-cmd amber-maple.local CALIBRATE 10   # Capture 10s baseline
+# Wait for: EVENT,amber-maple,calibrate=done packets=1000 nsub=52
+
+# 2. Verify baseline
+esp-cmd amber-maple.local CALIBRATE STATUS  # Should show "valid nsub=52"
+
+# 3. Enable presence detection
+esp-cmd amber-maple.local PRESENCE ON       # Starts scoring
+
+# 4. Tune threshold (optional)
+esp-cmd amber-maple.local PRESENCE THRESHOLD 0.08  # Higher = less sensitive
+```
+
+### How It Works
+
+- **Baseline:** Average per-subcarrier amplitude over N seconds (stored in NVS)
+- **Scoring:** Normalized Euclidean distance: `sqrt(sum((live-baseline)^2) / sum(baseline^2))`
+- **Window:** Rolling average of 50 scores
+- **Threshold:** Default 0.05 (5% normalized distance)
+- **Holdoff:** 10s debounce between state transitions
+- **Events:** `EVENT,<hostname>,presence=1 score=0.0832` / `EVENT,<hostname>,presence=0 score=0.0234`
+- **Memory:** ~1 KB total (baseline + accumulators + score buffer)
+
 ### LED States
 
 | LED | Meaning |
@@ -250,6 +290,8 @@ CSI_DATA,<hostname>,seq,mac,rssi,rate,...,len,first_word,"[I,Q,...]"       # RAW
 CSI_DATA,<hostname>,seq,mac,rssi,rate,...,len,first_word,"F:rms,std,max,idx,energy"  # COMPACT mode
 BLE_DATA,<hostname>,mac,rssi,pub|rnd,name
 EVENT,<hostname>,motion=0|1 rate=<hz> wander=<value>
+EVENT,<hostname>,calibrate=done packets=<n> nsub=<n>
+EVENT,<hostname>,presence=0|1 score=<float>
 ALERT_DATA,<hostname>,deauth|disassoc,sender_mac,target_mac,rssi
 ALERT_DATA,<hostname>,deauth_flood,<count>,<window_s>
 PROBE_DATA,<hostname>,mac,rssi,ssid
@@ -288,6 +330,9 @@ only generated on ESP32-C6 and newer chips.
 | hybrid_n | 10 | Raw packet interval (hybrid mode) |
 | auth | on/off | HMAC command authentication |
 | flood_thresh | 5/10 | Deauth flood: count/window_seconds |
+| powersave | on/off | WiFi modem sleep |
+| presence | on/off | Presence detection |
+| pr_score | 0.0432 | Current presence score (0 = no change from baseline) |
 
 ## PROFILE Sections