Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/backend/ble/bluez_adapter.py

@@ -259,9 +259,13 @@ class BlueZGATTAdapter:
         """Handle unsubscription from characteristic notifications."""
         logger.info("Client unsubscribed from %s", characteristic.uuid)
 
-    async def start(self) -> bool:
+    async def start(self, retries: int = 3, retry_delay: float = 2.0) -> bool:
         """Start the BLE GATT server.
 
+        Args:
+            retries: Number of startup attempts (for boot timing issues)
+            retry_delay: Delay between retries in seconds
+
         Returns:
             True if started successfully, False otherwise
         """
@@ -269,39 +273,57 @@ class BlueZGATTAdapter:
             logger.warning("BLE server already running")
             return True
 
-        try:
-            self._loop = asyncio.get_running_loop()
+        last_error = None
+        for attempt in range(retries):
+            try:
+                self._loop = asyncio.get_running_loop()
 
-            # Create bless server
-            self.server = BlessServer(name=self.device_name, loop=self._loop)
+                # Create bless server
+                self.server = BlessServer(name=self.device_name, loop=self._loop)
 
-            # Set up callbacks (bless 0.3.0+ API)
-            self.server.read_request_func = self._on_read
-            self.server.write_request_func = self._on_write
+                # Set up callbacks (bless 0.3.0+ API)
+                self.server.read_request_func = self._on_read
+                self.server.write_request_func = self._on_write
 
-            # Build and add GATT structure
-            gatt = self._build_gatt_dict()
-            await self.server.add_gatt(gatt)
+                # Build and add GATT structure
+                gatt = self._build_gatt_dict()
+                await self.server.add_gatt(gatt)
 
-            # Start the server (begins advertising)
-            await self.server.start()
+                # Start the server (begins advertising)
+                await self.server.start()
 
-            # Start GATT server handlers
-            await self.gatt_server.start()
+                # Start GATT server handlers
+                await self.gatt_server.start()
 
-            # Register notification callbacks
-            self._setup_notification_callbacks()
+                # Register notification callbacks
+                self._setup_notification_callbacks()
 
-            self._is_running = True
-            logger.info("BLE GATT server started, advertising as '%s'", self.device_name)
-            return True
+                self._is_running = True
+                logger.info("BLE GATT server started, advertising as '%s'", self.device_name)
+                return True
 
-        except Exception as e:
-            logger.error("Failed to start BLE server: %s", e)
-            import traceback
-            traceback.print_exc()
-            self._is_running = False
-            return False
+            except Exception as e:
+                last_error = e
+                if attempt < retries - 1:
+                    logger.warning(
+                        "BLE server start attempt %d/%d failed: %s, retrying in %.1fs...",
+                        attempt + 1, retries, e, retry_delay
+                    )
+                    # Clean up failed server before retry
+                    if self.server:
+                        try:
+                            await self.server.stop()
+                        except Exception:
+                            pass
+                        self.server = None
+                    await asyncio.sleep(retry_delay)
+                else:
+                    logger.error("Failed to start BLE server after %d attempts: %s", retries, e)
+                    import traceback
+                    traceback.print_exc()
+
+        self._is_running = False
+        return False
 
     def _setup_notification_callbacks(self):
         """Set up notification callbacks for characteristics that support notify."""