Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PROJECT_STATUS.md

@@ -1,6 +1,6 @@
 # Dangerous Pi - Project Status
 
-**Last Updated**: 2026-01-04
+**Last Updated**: 2026-03-03
 
 ## ✅ Phase 3 Complete - Hardware Testing Passed
 
@@ -12,6 +12,84 @@ All MVP features tested on actual hardware:
 
 ---
 
+## 📊 Feature Evaluation Summary (2026-03-03)
+
+| Feature | Completion | Backend | Frontend | Notes |
+|---------|------------|---------|----------|-------|
+| **HTTPS** | ✅ 100% | ✅ Complete | ✅ Toggle + info | Done 2026-03-03 |
+| **Authentication** | 40% | ✅ Basic + WS tokens | ✅ Login prompt | WebSocket protected |
+| **Plugin System** | 85% | ✅ Complete + hooks wired | ✅ Complete | Remote install missing |
+
+### 🔐 Security Gaps (Remaining)
+
+1. **Single User Only**: Basic HTTP auth with hardcoded username, no multi-user support
+2. **No Logout**: Active sessions cannot be revoked
+3. **No JWT**: Still using Basic Auth for REST endpoints (tokens only for WS)
+
+### ✅ HTTPS (100% Complete - Done 2026-03-03)
+
+**Implemented:**
+- SSL API endpoints fully working (`/api/system/ssl/info`, `/api/system/ssl/regenerate`)
+- Certificate generation script with EC P-256 keys, 10-year validity (`scripts/generate-ssl-cert.sh`)
+- nginx HTTPS config with TLS 1.2/1.3, HSTS, modern ciphers (`nginx/dangerous-pi-https.conf`)
+- Captive portal detection for Android, iOS, Windows, macOS, Firefox, Kindle
+- Systemd services for auto-generation (`dangerous-pi-ssl-gen.service`)
+- nginx config switching script (`scripts/configure-nginx.sh`)
+- Pi-gen integration (stage 05-https-support)
+- Frontend displays HTTPS status badge in Settings
+- Subject Alternative Names: 192.168.4.1, dangerous-pi.local, localhost
+- ✅ Frontend Enable/Disable toggle (`POST /api/system/ssl/toggle`)
+- ✅ Certificate regeneration button in UI
+- ✅ SSL info display (expiration, SANs, SHA256 fingerprint)
+
+### 🔑 Authentication (40% Complete)
+
+**Implemented:**
+- Basic HTTP authentication (`app/backend/api/auth.py`)
+- `AUTH_ENABLED` environment variable toggle (default: false)
+- Single username/password via env vars
+- Conditional router protection when enabled
+- ✅ WebSocket token-based auth (`app/backend/api/token_store.py`) - Done 2026-03-03
+- ✅ `POST /api/auth/token` - exchange Basic Auth for WS token (24h TTL)
+- ✅ `GET /api/auth/status` - public endpoint for auth status check
+- ✅ WebSocket validates token query param, rejects with close code 4401
+- ✅ Frontend LoginPrompt modal (`app/frontend/app/components/LoginPrompt.tsx`)
+- ✅ WebSocket manager handles auth flow (token fetch, retry, auth_required state)
+
+**Missing:**
+- JWT token-based auth for REST endpoints
+- Multi-user support
+- User management
+- Role-based access control (RBAC)
+- Logout functionality
+- Session revocation
+
+**Estimated to Complete:** ~2-3 weeks (full system, JWT + multi-user + RBAC)
+
+### 🔌 Plugin System (85% Complete)
+
+**Implemented:**
+- Plugin Manager: 804 lines, full lifecycle (load/enable/disable/unload)
+- Hook system: `register_hook()` and `trigger_hook()` methods implemented
+- Header widget system: severity levels (INFO/WARNING/ERROR/SUCCESS), dismissible, actions, expiration
+- Hardware access layer: GPIO, I2C, SPI, Serial with permission enforcement
+- 7 API endpoints: discover, list, info, enable, disable, load, unload
+- Frontend UI: discovery button, plugin listing, enable/disable toggles, permission badges
+- Hello World example plugin with registered hooks
+- WebSocket broadcasting capability for plugins (requires `websocket` permission)
+- ✅ Hook triggers wired in PM3 service (`pm3_command` hook) - Done 2026-03-03
+- ✅ Hook triggers wired in Update manager (`update_check` hook) - Done 2026-03-03
+
+**Missing:**
+- Remote plugin installation (from GitHub releases)
+- pip dependency management
+- Permission consent dialog before enabling
+
+**Estimated to Complete:**
+- Remote installation: ~1-2 weeks
+
+---
+
 ## ✅ Completed Features
 
 ### Backend (Python + FastAPI)
@@ -90,15 +168,21 @@ All MVP features tested on actual hardware:
   - Guided workflow triggers via BLE
   - For React Native mobile app integration
 
-**Plugin Framework (Complete):**
-- ✅ Dynamic plugin loading/unloading
+**Plugin Framework (85% Complete - See Feature Evaluation):**
+- ✅ Dynamic plugin loading/unloading (804-line plugin manager)
 - ✅ Plugin lifecycle management (load, enable, disable, unload)
-- ✅ Hook system for extensibility
-- ✅ JSON-based metadata
+- ✅ Hook system: `register_hook()` and `trigger_hook()` fully implemented
+- ✅ Hook triggers wired in PM3 service and Update manager
+- ✅ Header widget system with severity levels, actions, expiration
+- ✅ Hardware access layer: GPIO, I2C, SPI, Serial with permission checks
+- ✅ JSON-based metadata with permissions and dependencies
 - ✅ Plugin discovery from directory
 - ✅ Enable/disable individual plugins
-- ✅ Example "Hello World" plugin
-- ✅ 7 Plugin API endpoints
+- ✅ Example "Hello World" plugin with registered hooks
+- ✅ 7 Plugin API endpoints (discover, list, info, enable, disable, load, unload)
+- ✅ Frontend UI with discovery, listing, toggle controls, permission badges
+- ❌ Remote plugin installation not implemented
+- ❌ pip dependency management not implemented
 
 **Proxmark3 Firmware Enhancements (Complete - 2025-12-02):**
 - ✅ Two-channel hardware PWM LED brightness control
@@ -175,9 +259,10 @@ All MVP features tested on actual hardware:
 - ✅ **PowerWidget** - Real-time UPS/battery status in header
 - ✅ **ConnectDialog** - PM3 connection management
 - ✅ **QRScanner** - HTML5-based QR code scanning
+- ✅ **LoginPrompt** - Modal login form for WebSocket auth
 
 **Hooks:**
-- ✅ **useWebSocket** - Singleton WebSocket manager with event subscriptions
+- ✅ **useWebSocket** - Singleton WebSocket manager with event subscriptions and token auth
 
 **Performance:**
 - ✅ Server-side rendering (SSR)
@@ -268,15 +353,17 @@ All MVP features tested on actual hardware:
 
 ### Medium Priority
 
-6. **Authentication**
-   - Optional password protection
-   - Session cookies
-   - Login page
+6. **Authentication** (40% Complete - See Feature Evaluation)
+   - ✅ Basic HTTP auth (backend)
+   - ✅ WebSocket token auth with LoginPrompt
+   - ❌ JWT tokens needed for REST
+   - ❌ Multi-user support needed
+   - ❌ RBAC needed
 
-7. **HTTPS Support**
-   - Self-signed certificate generation
-   - Automatic cert creation on first boot
-   - Toggle in settings
+7. **HTTPS Support** ✅ COMPLETE
+   - ✅ Self-signed certificate generation
+   - ✅ Automatic cert creation on first boot
+   - ✅ Frontend toggle and cert info display
 
 8. **Advanced PM3 Features**
    - Waveform viewer with pan/zoom
@@ -319,7 +406,7 @@ All MVP features tested on actual hardware:
 - **Lines of Code**: ~2,500+
 - **Files**: 13+
 - **Pages**: 5 (Dashboard, Commands, Settings, Logs, Updates)
-- **Components**: 4 (DeviceSelector, PowerWidget, ConnectDialog, QRScanner)
+- **Components**: 5 (DeviceSelector, PowerWidget, ConnectDialog, QRScanner, LoginPrompt)
 - **Hooks**: 1 (useWebSocket)
 - **CSS**: 15KB (uncompressed)
 - **Bundle Size**: ~120KB (estimated, gzipped)
@@ -506,7 +593,8 @@ dangerous-pi/
 │   │   │   ├── wifi.py             # WiFi management
 │   │   │   ├── updates.py          # Update management
 │   │   │   ├── plugins.py          # Plugin management
-│   │   │   └── auth.py             # Authentication
+│   │   │   ├── auth.py             # Authentication + token endpoints
+│   │   │   └── token_store.py      # In-memory WS auth tokens
 │   │   ├── websocket/              # WebSocket real-time events
 │   │   │   ├── manager.py          # Connection manager
 │   │   │   ├── routes.py           # WebSocket endpoint
@@ -552,7 +640,8 @@ dangerous-pi/
 │   │   │   │   ├── DeviceSelector.tsx  # Multi-device selection
 │   │   │   │   ├── PowerWidget.tsx     # UPS/battery status
 │   │   │   │   ├── ConnectDialog.tsx   # Connection management
-│   │   │   │   └── QRScanner.tsx       # QR code scanning
+│   │   │   │   ├── QRScanner.tsx       # QR code scanning
+│   │   │   │   └── LoginPrompt.tsx     # WS auth login modal
 │   │   │   ├── hooks/              # Custom React hooks
 │   │   │   │   └── useWebSocket.ts # WebSocket singleton manager
 │   │   │   ├── root.tsx            # Root layout
@@ -767,10 +856,12 @@ Want to add features? Follow these steps:
 - [ ] Performance optimization on Pi Zero 2 W (ongoing)
 - [ ] WiFi mode detection fix (reports "client" when in AP mode)
 
-### Phase 4: Enhancement 📋 PLANNED
+### Phase 4: Enhancement 🚧 IN PROGRESS
 - [ ] Backup system
-- [ ] Authentication
-- [ ] HTTPS support
+- [x] HTTPS Settings UI (toggle, cert info, regenerate) - Done 2026-03-03
+- [x] Plugin hook wiring (pm3_command, update_check) - Done 2026-03-03
+- [x] WebSocket authentication (token-based) - Done 2026-03-03
+- [ ] Full authentication (JWT, multi-user, RBAC)
 - [ ] Additional plugins
 - [ ] Advanced PM3 features