feat: validate credentials, persist them, and switch without rebooting

docs/RELEASE_GUIDE.md

@@ -92,6 +92,14 @@ state/delivery latency with the hard limits in `RESOURCE_BUDGET.md`.
   state polling and retries WebSocket at 1, 2, 5, then 10 seconds.
 - If the board has a new DHCP address, use the router/serial information and
   open the new local URL. No fixed IP or external service is required.
+- For a saved network that does not become operational, the serial log records
+  the profile outcome, Wi-Fi disconnect reason, the 30-second timeout, AP
+  startup result, and STA/AP addresses. `fallback AP active` means that
+  `Battleship-open` should be available; connect to it and open
+  `http://192.168.4.1/setup`. These diagnostics never include the password.
+- A corrupt or unsupported saved record is left intact for diagnosis but is
+  ignored for that boot; the board starts `Battleship-open`. Do not erase NVS
+  or flash as an initial recovery step.
 - If LittleFS assets fail to load, repeat `uploadfs` for the confirmed target
   port before reflashing firmware. Do not format LittleFS automatically.
 - Capture `/api/health`, reset reason, and the exact source revision before