docs: Add WiFi probe request capture to roadmap and TODO

ROADMAP.md

@@ -58,6 +58,10 @@
 - [ ] Comprehensive error handling
 
 ## Future
+- WiFi probe request capture (promiscuous mode, WIFI_PKT_MGMT)
+  - Capture client SSID searches → `PROBE_DATA,<mac>,<rssi>,<ssid>` via UDP
+  - Uses `esp_wifi_set_promiscuous` with management frame filter
+  - Can coexist with CSI (both use promiscuous callbacks)
 - ESP-NOW mesh (ESP32-to-ESP32 CSI)
 - Multi-channel scanning
 - External sensor support (PIR, temp/humidity via GPIO)

TODO.md

@@ -30,6 +30,7 @@
 - [ ] Compare CSI quality: passive (router) vs active (ESP-NOW)
 
 ## Ideas
+- WiFi probe request capture — sniff client SSID searches via promiscuous mode
 - ESP-NOW mesh for direct ESP32-to-ESP32 CSI
 - External PIR sensor for CSI ground truth validation
 - Battery + deep sleep mode for portable deployment