feat: ContextVM (MCP over Nostr) server with WS masking fix

- Full CVM server: persistent WS relay listener, kind 25910 subscription
- MCP protocol handlers: initialize, tools/list, tools/call, ping
- 10 MCP tools: get_config, set_config, get_balance, wallet_send,
  get_sessions, get_usage, set_payout, set_metric, set_price, wallet_melt
- CEP-6 announcements via WS (kinds 11316, 11317, 10002)
- Auth check: owner npub only
- Fix: WebSocket client-to-server frame masking (RFC 6455 requirement)
- Fix: Raw event JSON in EVENT wrapper (no re-parsing that breaks sig)
- SNTP init after STA gets IP
- 282 unit tests passing (61 CVM + 60 MCP handler + 161 existing)
- Integration test scaffold: tests/integration/test-cvm.mjs

1 files changed, 39 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index 40f0e7b..c84acdf 100644
--- a/Makefile
+++ b/Makefile
@@ -23,9 +23,10 @@ TOLLGATE_IP ?= 10.192.45.1
 .PHONY: flash flash-a flash-b monitor monitor-a monitor-b
 .PHONY: test test-unit test-integration test-e2e test-all
 .PHONY: test-smoke test-api test-network test-portal test-payment
-.PHONY: test-reset-auth test-session-expiry test-dns-firewall
+.PHONY: test-reset-auth test-session-expiry test-dns-firewall test-cvm
 .PHONY: tokens wallet-setup wallet-info wallet-balance mint-token send-token
 .PHONY: clean erase-nvs reset serial-log bootstrap-config
+.PHONY: cvm-pubkey cvm-test-tool cvm-announce
 
 help:
         @echo "TollGate ESP32 — Makefile"
@@ -50,6 +51,12 @@ help:
         @echo "  test-reset-auth   Reset auth + per-client NAT filter test"
         @echo "  test-dns-firewall DNS hijack + NAT filter test"
         @echo "  test-session-expiry Session lifecycle with 65s expiry wait"
+        @echo "  test-cvm          ContextVM protocol integration test"
+        @echo ""
+        @echo "ContextVM:"
+        @echo "  cvm-pubkey        Print board's ContextVM npub"
+        @echo "  cvm-announce      Trigger re-publish of CEP-6 announcements"
+        @echo "  cvm-test-tool     Send single MCP tools/call (METHOD=get_config)"
         @echo ""
         @echo "Wallet:"
         @echo "  wallet-setup      Initialize nutshell wallet for test mint"
@@ -153,7 +160,7 @@ test-unit:
         @echo "=== Running host unit tests ==="
         $(MAKE) -C tests/unit test
 
-test-integration: test-api test-network test-reset-auth test-dns-firewall
+test-integration: test-api test-network test-reset-auth test-dns-firewall test-cvm
         @echo "=== Integration tests passed ==="
 
 test-e2e:
@@ -198,6 +205,10 @@ test-dns-firewall:
         @echo "=== Running DNS + firewall test ==="
         TOLLGATE_IP=$(TOLLGATE_IP) $(NODE) tests/integration/test-dns-firewall.mjs
 
+test-cvm:
+        @echo "=== Running CVM integration test ==="
+        TOLLGATE_IP=$(TOLLGATE_IP) $(NODE) tests/integration/test-cvm.mjs
+
 # ──────────────────────────────────────────────
 # Wallet
 # ──────────────────────────────────────────────
@@ -230,6 +241,32 @@ send-token:
 tokens: send-token
 
 # ──────────────────────────────────────────────
+# ContextVM
+# ──────────────────────────────────────────────
+
+cvm-pubkey:
+        @echo "=== Board ContextVM npub ==="
+        @nak key public a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2 | xargs -I{} nak encode npub {}
+        @echo ""
+        @echo "Search for this npub on https://contextvm.org/servers"
+
+cvm-announce:
+        @echo "=== Triggering CEP-6 re-announcement ==="
+        curl -s http://$(TOLLGATE_IP):2121/ | head -1 || echo "Board not reachable"
+
+cvm-test-tool:
+        @METHOD=$${METHOD:-get_config}; \
+        PARAMS=$${PARAMS:-{}}; \
+        echo "=== Calling $$METHOD via CVM ==="; \
+        NPUB_HEX=$$(nak key public a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2); \
+        CONTENT="$$(echo "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$$METHOD\",\"arguments\":$$PARAMS}}" | jq -c .)"; \
+        EVENT_JSON="$$(nak event --kind 25910 --tag p=$$NPUB_HEX --content "$$CONTENT" wss://relay.damus.io 2>/dev/null)"; \
+        echo "Published: $$EVENT_JSON"; \
+        echo "Waiting for response..."; \
+        sleep 3; \
+        nak req -k 25910 -a $$NPUB_HEX -l 5 wss://relay.damus.io
+
+# ──────────────────────────────────────────────
 # Utilities
 # ──────────────────────────────────────────────