Captive portal detection fix + Phase 2 tests 16-18,20 passing (17/17)

- Add DoT reject server on port 853 (TCP RST forces DNS-over-TLS fallback)
- DNS hijack returns NXDOMAIN for all non-A query types (no forwarding for unauthed)
- Shorter TTL on hijack responses (10s) for faster captive detection
- Explicit 302 redirect handlers for /generate_204, /hotspot-detect.html, etc.
- HTTP and DNS request logging for debugging captive detection
- Per-MAC tracking in firewall (find_by_mac, get_mac_for_ip with ARP fallback)
- Session MAC tracking (session_find_by_mac)
- Phase 2 test 18: add route through TollGate before ping test
- All 17 Phase 2 tests pass (15-21 + whoami + portal form)

1 files changed, 5 insertions, 0 deletions

diff --git a/main/firewall.h b/main/firewall.h
index 91a89b0..e5d492a 100644
--- a/main/firewall.h
+++ b/main/firewall.h
@@ -6,6 +6,8 @@
 #include <stdbool.h>
 #include <stdint.h>
 
+#define FW_MAX_MAC_LEN 18
+
 esp_err_t firewall_init(esp_ip4_addr_t ap_ip);
 void firewall_enable_nat(void);
 void firewall_disable_nat(void);
@@ -13,6 +15,9 @@ void firewall_grant_access(uint32_t client_ip);
 void firewall_revoke_access(uint32_t client_ip);
 void firewall_revoke_all(void);
 bool firewall_is_client_allowed(uint32_t client_ip);
+bool firewall_is_mac_allowed(const char *mac);
 int firewall_client_count(void);
 
+esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size);
+
 #endif