feat: implement the open fallback access point and captive portal

docs/RELEASE_GUIDE.md

@@ -13,8 +13,9 @@ does not replace the locked rules in [MVP.md](MVP.md), the HTTP contract in
   `esp_littlefs` 1.20.4.
 - USB serial device: normally `/dev/ttyACM0`; confirm with `pio device list`
   before an upload.
-- A local `include/wifi_config.h`, copied from `include/wifi_config.h.example`.
-  It is ignored by Git. Never commit the SSID or password.
+- No firmware-embedded Wi-Fi credentials are required. On first boot, join the
+  open `Battleship-open` network and open `http://192.168.4.1/setup` if the
+  captive portal does not appear.
 
 ## Build and upload
 
@@ -49,6 +50,16 @@ The response includes free/minimum heap, largest free block, connection count,
 rejected input count, Wi-Fi state, and reset reason. It must not contain Wi-Fi
 credentials or session tokens.
 
+## Network configuration and local-security limitation
+
+The `/setup` screen and `/api/network/*` routes are intentionally unauthenticated
+so a new device can be configured through either the fallback AP or its regular
+local address. Any client that can reach the device can change or delete the
+saved Wi-Fi configuration. The open AP and plain local HTTP do not protect a
+submitted password from a nearby network observer. Configure the board only on
+a network you trust, and do not use this feature for credentials that require
+strong confidentiality.
+
 ## MVP acceptance checklist
 
 Record the observed result, device address, browser/device model, and any