Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pi-gen/stageDangerousPi/01-Wireless-AP/00-run-chroot.sh

@@ -391,6 +391,9 @@ EOF
 
 systemctl enable dangerous-pi-ap.service
 
+# Ensure NetworkManager is enabled (pi-gen may not carry the default)
+systemctl enable NetworkManager
+
 # Ensure hostapd and dnsmasq start AFTER network is configured
 mkdir -p /etc/systemd/system/hostapd.service.d
 cat > /etc/systemd/system/hostapd.service.d/override.conf << 'EOF'

pi-gen/stageDangerousPi/04-pisugar/SKIP

@@ -1,2 +0,0 @@
-# Remove this file to enable PiSugar installation
-# PiSugar support is optional and disabled by default

pi-gen/stageDangerousPi/05-https-support/00-run-chroot.sh

@@ -1,24 +1,17 @@
 #!/bin/bash -e
 # Configure HTTPS support for Dangerous Pi
-# Installs SSL certificate generation and nginx configuration switching
+# Sets up SSL certificate generation and nginx configuration switching
+# Note: Scripts and configs are already in /opt/dangerous-pi/ from stage 03
 
 echo "=== Setting up HTTPS support ==="
 
-# Create SSL directory
+# Create SSL directory for certificates
 mkdir -p /opt/dangerous-pi/ssl
-mkdir -p /opt/dangerous-pi/nginx
 
-# Install certificate generation script
-echo "Installing SSL certificate generation script..."
-install -m 755 /opt/dangerous-pi/scripts/generate-ssl-cert.sh /opt/dangerous-pi/scripts/
-
-# Install nginx configuration switcher
-echo "Installing nginx configuration switcher..."
-install -m 755 /opt/dangerous-pi/scripts/configure-nginx.sh /opt/dangerous-pi/scripts/
-
-# Copy HTTPS nginx configuration
-echo "Installing HTTPS nginx configuration..."
-cp /opt/dangerous-pi/nginx/dangerous-pi-https.conf /opt/dangerous-pi/nginx/
+# Set executable permissions on scripts (already copied by stage 03)
+echo "Setting script permissions..."
+chmod 755 /opt/dangerous-pi/scripts/generate-ssl-cert.sh
+chmod 755 /opt/dangerous-pi/scripts/configure-nginx.sh
 
 # Install systemd service for first-boot certificate generation
 echo "Installing SSL certificate generation service..."