feat: Auto-generate auth secret and enforce HMAC on privileged commands

- Generate 128-bit random auth secret on first boot via hardware RNG,
  persist to NVS, log to serial for retrieval
- Gate destructive commands (OTA, FACTORY, REBOOT, TARGET, AUTH,
  HOSTNAME set) behind HMAC authentication
- Read-only and operational commands remain open for monitoring
- Require WPA2/WPA3 for WiFi AP association (reject open/WEP)

get-started/csi_recv_router/sdkconfig.defaults

@@ -82,3 +82,8 @@ CONFIG_ESP_WIFI_IRAM_OPT=n
 #
 CONFIG_PM_ENABLE=y
 CONFIG_FREERTOS_USE_TICKLESS_IDLE=y
+
+#
+# WiFi Authentication (reject open/WEP APs)
+#
+CONFIG_EXAMPLE_WIFI_AUTH_WPA2_WPA3_PSK=y