ebc8a00b46
- Generate 128-bit random auth secret on first boot via hardware RNG, persist to NVS, log to serial for retrieval - Gate destructive commands (OTA, FACTORY, REBOOT, TARGET, AUTH, HOSTNAME set) behind HMAC authentication - Read-only and operational commands remain open for monitoring - Require WPA2/WPA3 for WiFi AP association (reject open/WEP)