Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/backend/api/token_store.py

@@ -0,0 +1,55 @@
+"""In-memory token store for WebSocket authentication.
+
+Tokens are short-lived (24h) and stored in memory. Since this is a
+single-device appliance with typically one user, persistence is not needed.
+Tokens are cleaned up lazily on create/validate calls.
+"""
+import secrets
+from datetime import datetime, timezone, timedelta
+
+_tokens: dict[str, dict] = {}
+TOKEN_TTL_HOURS = 24
+
+
+def create_token(username: str) -> str:
+    """Create a new auth token for the given username.
+
+    Args:
+        username: The authenticated username
+
+    Returns:
+        URL-safe token string
+    """
+    token = secrets.token_urlsafe(32)
+    _tokens[token] = {
+        "username": username,
+        "expires_at": datetime.now(timezone.utc) + timedelta(hours=TOKEN_TTL_HOURS),
+    }
+    _cleanup_expired()
+    return token
+
+
+def validate_token(token: str) -> str | None:
+    """Validate a token and return the associated username.
+
+    Args:
+        token: The token to validate
+
+    Returns:
+        Username if valid, None if invalid or expired
+    """
+    entry = _tokens.get(token)
+    if not entry:
+        return None
+    if datetime.now(timezone.utc) > entry["expires_at"]:
+        del _tokens[token]
+        return None
+    return entry["username"]
+
+
+def _cleanup_expired() -> None:
+    """Remove expired tokens."""
+    now = datetime.now(timezone.utc)
+    expired = [t for t, e in _tokens.items() if now > e["expires_at"]]
+    for t in expired:
+        del _tokens[t]