Unique SSID/IP per board + captive detection fix + mint list in portal

- Derive unique SSID (TollGate-{MAC4}{MAC5}) and AP IP (10.{b5}.{subnet}.1)
  from factory MAC — boards no longer conflict
- Board A: TollGate-377C @ 10.55.85.1, Board B: TollGate-5050 @ 10.80.10.1
- Captive portal detection URIs return 200 with portal HTML (matching
  esp32-mesh working approach) instead of 302 redirect
- Dynamic AP IP in portal HTML via __AP_IP__ template substitution
- Supported mints section in portal page (shows mint URL, tap to copy)
- Fixed mint URL to testnut.cashu.space (was stale in SPIFFS)
- DoT reject server on port 853 for DNS-over-TLS fallback
- DNS hijack: NXDOMAIN for all non-A queries, no forwarding for unauthed
- Playwright tests updated for 200 response on detection URIs
- Phase 2 test suite: 20/21 pass (test 22 expiry ping route issue)
- Tests 25-27 deferred to Phase 3 (Board B as second client)

1 files changed, 2 insertions, 3 deletions

diff --git a/CHECKLIST.md b/CHECKLIST.md
index 2ac593c..d5711b4 100644
--- a/CHECKLIST.md
+++ b/CHECKLIST.md
@@ -63,9 +63,8 @@
 - [x] Test: /whoami returns ip=X.X.X.X mac=XX:XX:XX:XX:XX:XX — PASSING
 - [x] Test: Portal has payment form (Cashu token input + Pay button) — PASSING
 
-### Tests Not Yet Run (need Playwright)
-- [ ] Test 24: Portal payment form visible in browser (Playwright)
-- [ ] Test 25: Two clients pay independently
+### Tests Not Yet Run (deferred to Phase 3 — will use Board B as second client)
+- [ ] Test 25: Two clients pay independently (laptop + Board B)
 - [ ] Test 26: Client isolation (only payer gets internet)
 - [ ] Test 27: Full e2e: portal → pay → browse