feat: ContextVM (MCP over Nostr) server with full integration

Complete CVM implementation: persistent WebSocket relay listener,
kind 25910 event subscription, MCP protocol handlers, CEP-6 announcements,
10 MCP tools, per-board hardware locks, WiFi EU regulatory fix.

Architecture:
- cvm_server.c: WS relay listener, kind 25910 subscription, MCP dispatch
- mcp_handler.c/h: 10 MCP tools (get_config, set_config, get_balance,
  wallet_send, get_sessions, get_usage, set_payout, set_metric,
  set_price, wallet_melt)
- Responses published via existing WS connection (not new TLS)
- Auth check: only owner npub accepted
- CEP-6: kinds 11316 (server), 11317 (tools), 10002 (relay list)
- WS ping/pong keepalive every 30s, 60s TLS read timeout

Critical fixes:
- WiFi country code DE (ESP-IDF defaults to CN, breaks EU APs)
- Subscription #p filter must be array not string
- Use-after-free: tags_str freed before nostr_event_to_json
- MCP responses via existing WS (ESP32 can't open multiple TLS)
- EVENT msg buffer underflow, WS frame masking, TLS write loop

Per-board hardware locks:
- Lock files in physical-router-test-automation/locks/
- lock-a/b/c, unlock-a/b/c targets in 3 Makefiles
- All hardware-touching targets require board lock

Verified on Board B via relay.primal.net:
- 282 unit tests passing (61 CVM + 60 MCP + 161 existing)
- MCP initialize roundtrip: PASS
- tools/list: PASS
- tools/call get_config: PASS
- tools/call get_balance: PASS
- tools/call set_price: PASS (write operation)
- CEP-6 announcements (11316, 11317, 10002): all accepted by relay
- WiFi STA connection (EnterSSID-2.4GHz): PASS with country code DE
- Board A WiFi confirmed hardware issue (not firmware)

1 files changed, 9 insertions, 4 deletions

diff --git a/main/config.c b/main/config.c
index e937fb3..9dd2a1d 100644
--- a/main/config.c
+++ b/main/config.c
@@ -16,7 +16,7 @@ esp_err_t tollgate_config_init(void)
 {
     memset(&g_config, 0, sizeof(g_config));
     g_config.max_retry = 5;
-    g_config.ap_channel = 1;
+    g_config.ap_channel = 6;
     g_config.ap_max_conn = 4;
     g_config.price_per_step = 21;
     g_config.step_size_ms = 60000;
@@ -33,8 +33,8 @@ esp_err_t tollgate_config_init(void)
     g_config.payout.check_interval_s = 60;
     g_config.payout.recipient_count = 0;
     g_config.payout.mint_count = 0;
-    g_config.cvm_enabled = false;
-    strncpy(g_config.cvm_relays, "wss://relay.damus.io", sizeof(g_config.cvm_relays) - 1);
+    g_config.cvm_enabled = true;
+    strncpy(g_config.cvm_relays, "wss://relay.primal.net", sizeof(g_config.cvm_relays) - 1);
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -54,7 +54,9 @@ esp_err_t tollgate_config_init(void)
         const char *default_json = "{"
             "\"nsec\":\"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2\","
             "\"wifi_networks\":["
-              "{\"ssid\":\"EnterSSID-2.4GHz\",\"password\":\"c03rad0r123!\"}"
+              "{\"ssid\":\"EnterSSID-2.4GHz\",\"password\":\"c03rad0r123!\"},"
+              "{\"ssid\":\"c03rad0r\",\"password\":\"c03rad0r123\"},"
+              "{\"ssid\":\"TK-GAESTE\",\"password\":\"\"}"
             "],"
             "\"ap_password\":\"\","
             "\"mint_url\":\"https://testnut.cashu.space\","
@@ -289,6 +291,9 @@ esp_err_t tollgate_config_get_wifi(wifi_config_t *wifi_config)
     strncpy((char *)wifi_config->sta.ssid, g_config.networks[idx].ssid, sizeof(wifi_config->sta.ssid) - 1);
     strncpy((char *)wifi_config->sta.password, g_config.networks[idx].password, sizeof(wifi_config->sta.password) - 1);
     wifi_config->sta.threshold.authmode = WIFI_AUTH_WPA2_PSK;
+    wifi_config->sta.pmf_cfg.capable = true;
+    wifi_config->sta.pmf_cfg.required = false;
+    wifi_config->sta.scan_method = WIFI_ALL_CHANNEL_SCAN;
     return ESP_OK;
 }