Phase 7: MCP handler (25 tests), NIP-04 encrypt/decrypt (15 tests), CVM server skeleton

- mcp_handler.c/h: 4 tools (get_config, set_config, get_balance, wallet_send)
- nip04.c/h: AES-256-CBC + ECDH with 0x02 compressed pubkey prefix
  - Fixed IV copy bug: mbedTLS AES-CBC modifies IV in-place
  - Base64 encode/decode for ciphertext transport
  - PKCS7 padding
- cvm_server.c/h: Nostr DM listener with FreeRTOS task
- config: cvm_enabled, cvm_relays fields
- 156 total tests passing across 10 test binaries

1 files changed, 12 insertions, 0 deletions

diff --git a/main/config.c b/main/config.c
index 3e01efc..2ee8637 100644
--- a/main/config.c
+++ b/main/config.c
@@ -33,6 +33,8 @@ esp_err_t tollgate_config_init(void)
     g_config.payout.check_interval_s = 60;
     g_config.payout.recipient_count = 0;
     g_config.payout.mint_count = 0;
+    g_config.cvm_enabled = false;
+    strncpy(g_config.cvm_relays, "wss://relay.damus.io", sizeof(g_config.cvm_relays) - 1);
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -235,6 +237,16 @@ esp_err_t tollgate_config_init(void)
         }
     }
 
+    cJSON *cvm = cJSON_GetObjectItem(root, "cvm");
+    if (cvm && cJSON_IsObject(cvm)) {
+        cJSON *cvm_en = cJSON_GetObjectItem(cvm, "enabled");
+        if (cvm_en && cJSON_IsBool(cvm_en)) g_config.cvm_enabled = cJSON_IsTrue(cvm_en);
+        cJSON *cvm_relays = cJSON_GetObjectItem(cvm, "relays");
+        if (cvm_relays && cJSON_IsString(cvm_relays)) {
+            strncpy(g_config.cvm_relays, cvm_relays->valuestring, sizeof(g_config.cvm_relays) - 1);
+        }
+    }
+
     if (g_config.payout.mint_count == 0 && g_config.mint_url[0] != '\0') {
         strncpy(g_config.payout.mints[0].url, g_config.mint_url,
                 sizeof(g_config.payout.mints[0].url) - 1);