Phase 1 working: captive portal, DNS hijack, NAT-based access control

- Fix WiFi init order: netif creation before esp_wifi_init, set mode before set_config
- Replace broken netif input filter with NAPT on/off per authentication state
- NAPT disabled by default, enabled when client granted, disabled on revoke
- Fix test helpers: use -I wlp59s0 for ping, handle nslookup exit code 1
- All 20 API tests pass, all 6 smoke tests pass

1 files changed, 11 insertions, 0 deletions

diff --git a/main/captive_portal.h b/main/captive_portal.h
new file mode 100644
index 0000000..30d8c3e
--- /dev/null
+++ b/main/captive_portal.h
@@ -0,0 +1,11 @@
+#ifndef CAPTIVE_PORTAL_H
+#define CAPTIVE_PORTAL_H
+
+#include "esp_http_server.h"
+#include "esp_err.h"
+
+esp_err_t captive_portal_start(void);
+void captive_portal_stop(void);
+httpd_handle_t captive_portal_get_server(void);
+
+#endif