Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/backend/managers/wifi_manager.py

@@ -714,16 +714,27 @@ class WiFiManager:
             if "successfully activated" in result.lower():
                 logger.warning(f"[WiFi Connect] SUCCESS - connected to {ssid}")
 
-                # Verify we have an IP address
+                # Verify we have a non-AP IP address
                 await asyncio.sleep(2)
                 ip_result = await self._run_command(f"ip addr show {interface}")
                 logger.warning(f"[WiFi Connect] IP result: {ip_result}")
-                if "inet " in ip_result and "192.168.4." not in ip_result:
+
+                # Extract all IP addresses and check for non-AP IPs
+                # AP uses 192.168.4.x subnet
+                ip_matches = re.findall(r'inet (\d+\.\d+\.\d+\.\d+)', ip_result)
+                client_ips = [ip for ip in ip_matches if not ip.startswith("192.168.4.")]
+
+                if client_ips:
+                    logger.warning(f"[WiFi Connect] Found client IP(s): {client_ips}")
+                    # Remove the AP static IP since we're in client mode now
+                    await self._run_command(f"ip addr del 192.168.4.1/24 dev {interface}", check=False)
                     # Save client mode for boot persistence
                     self._current_mode = WiFiMode.CLIENT
                     self._save_mode(WiFiMode.CLIENT)
                     logger.info(f"WiFi client mode saved for boot persistence")
                     return True
+                else:
+                    logger.warning(f"[WiFi Connect] No client IP found, only AP IPs: {ip_matches}")
 
             # Connection failed
             logger.warning(f"[WiFi Connect] FAILED - {result}")