feat: implement the open fallback access point and captive portal

docs/API_CONTRACT.md

@@ -49,6 +49,10 @@ Failure (maximum 160 encoded bytes):
 | -------------------------- | --------------: | --------------------------------------------- |
 | `GET /api/info`            |    128 B target | public device/slot state and names, 384 B     |
 | `GET /api/health`          |    128 B target | diagnostics without secrets, 320 B; includes reset reason |
+| `GET /api/network/status`  |    128 B target | unauthenticated state/message; never includes SSID/password |
+| `GET /api/network/scan`    |    128 B target | unauthenticated bounded scan state and up to 12 SSIDs |
+| `POST /api/network/validate` | 160 B body | unauthenticated `{ssid,password}` validation; password is never returned |
+| `POST /api/network/delete` |       0 B body | unauthenticated deletion of the saved profile |
 | `POST /api/session/join`   |      192 B body | `{name,requestedRole}`; token and role, 192 B |
 | `POST /api/session/resume` |       96 B body | `{token}`; role and state metadata, 192 B     |
 | `POST /api/session/leave`  |       80 B body | `{token,gameId}`; releases only that session   |
@@ -82,6 +86,11 @@ polling returns `SESSION_INVALIDATED` with the same bounded recovery metadata.
 The recovery generation and `gameId` make delayed commands stale; retrying a
 completed recovery is harmless and cannot mutate a newly registered session.
 
+Network configuration is deliberately unauthenticated so it works from the
+open fallback AP and the regular local address. Any reachable client can change
+or delete the saved profile; the open AP and local HTTP do not provide password
+confidentiality. Network responses and diagnostics never include the password.
+
 ## Role-safe state event
 
 The HTTP state response and WebSocket `state` event use this single 768-byte