docs: Update TASKS, TODO, CHEATSHEET for probe capture and mDNS discovery

docs/CHEATSHEET.md

@@ -42,6 +42,7 @@ esp-cmd <host> ADAPTIVE ON              # Enable adaptive sampling (NVS saved)
 esp-cmd <host> ADAPTIVE OFF             # Disable adaptive sampling
 esp-cmd <host> THRESHOLD 0.005          # Set motion sensitivity (NVS saved)
 esp-cmd <host> OTA http://pi:8070/fw    # Trigger OTA update (use esp-ota instead)
+esp-cmd <host> HOSTNAME mydevice         # Set hostname (NVS saved, mDNS updated)
 esp-cmd <host> REBOOT                   # Restart device
 ```
 
@@ -112,6 +113,17 @@ esp-cmd amber-maple.local THRESHOLD 0.005  # Tune sensitivity
 | Solid (5s) | IDENTIFY command active |
 | Double blink | OTA in progress |
 
+## Sensor Discovery
+
+```bash
+esp-ctl discover                        # Find all sensors via mDNS
+esp-ctl discover -t 5                   # Longer browse (5s timeout)
+esp-ctl status --discover               # Status using discovered fleet
+esp-ctl target --discover               # Query targets via discovery
+```
+
+Requires firmware with `_esp-csi._udp` mDNS service (v1.1+).
+
 ## Test CSI Reception
 
 ```bash
@@ -119,6 +131,8 @@ nc -lu 5500                             # Listen for CSI packets
 socat UDP-RECV:5500 STDOUT              # Alternative listener
 nc -lu 5500 | head -1                   # See one packet
 nc -lu 5500 | wc -l                     # Count packets/sec (Ctrl+C)
+esp-ctl listen -f probe -n 5            # Capture 5 probe requests
+esp-ctl listen -f alert                 # Monitor deauth/disassoc alerts
 ```
 
 ## Firmware Variants
@@ -143,7 +157,7 @@ nc -lu 5500 | wc -l                     # Count packets/sec (Ctrl+C)
 ## USB Flash Notes
 
 - **Use 460800 baud** (`-b 460800`) — 921600 causes connection failures on some boards
-- Each device needs its own build with its hostname set in menuconfig
+- Hostname can be changed at runtime via `esp-ctl cmd <host> HOSTNAME <name>`
 - First flash after enabling OTA partitions must be via USB
 
 ## Data Packet Formats
@@ -155,6 +169,7 @@ CSI_DATA,<hostname>,seq,mac,rssi,rate,...,len,first_word,"[I,Q,...]"
 BLE_DATA,<hostname>,mac,rssi,pub|rnd,name
 EVENT,<hostname>,motion=0|1 rate=<hz> wander=<value>
 ALERT_DATA,<hostname>,deauth|disassoc,sender_mac,target_mac,rssi
+PROBE_DATA,<hostname>,mac,rssi,ssid
 ```
 
 ## Source Paths