Phase 3: Nostr identity derivation + wifistr service discovery

- Add identity.c/h: HMAC-SHA512 derivation from nsec → npub, STA/AP MAC, SSID, AP IP
- Add nostr_event.c/h: NIP-01 event serialization + Schnorr signing (BIP-340)
- Add geohash.c/h: lat/lon to geohash encoding
- Add wifistr.c/h: kind 38787 event builder + WebSocket publish to Nostr relays
- Update config.c/h: nsec-based identity, Nostr relay/geo config, remove static SSID/IP
- Replace custom mbedTLS wallet with nucula library (libsecp256k1)
- Remove wallet.c/h, wallet_persist.c/h (replaced by nucula_lib component)
- Verified on Board A: derived SSID, captive portal, payment, wallet, wifistr publish

1 files changed, 48 insertions, 0 deletions

diff --git a/main/geohash.c b/main/geohash.c
new file mode 100644
index 0000000..f649824
--- /dev/null
+++ b/main/geohash.c
@@ -0,0 +1,48 @@
+#include "geohash.h"
+#include <string.h>
+
+static const char BASE32[] = "0123456789bcdefghjkmnpqrstuvwxyz";
+
+void geohash_encode(double lat, double lon, int precision, char *out)
+{
+    double lat_range[2] = { -90.0, 90.0 };
+    double lon_range[2] = { -180.0, 180.0 };
+    uint8_t hash_bytes[16];
+    int bit_count = precision * 5;
+    int byte_count = (bit_count + 7) / 8;
+    memset(hash_bytes, 0, sizeof(hash_bytes));
+
+    for (int i = 0; i < bit_count; i++) {
+        int byte_idx = i / 8;
+        int bit_idx = 7 - (i % 8);
+
+        if (i % 2 == 0) {
+            double mid = (lon_range[0] + lon_range[1]) / 2.0;
+            if (lon >= mid) {
+                hash_bytes[byte_idx] |= (1 << bit_idx);
+                lon_range[0] = mid;
+            } else {
+                lon_range[1] = mid;
+            }
+        } else {
+            double mid = (lat_range[0] + lat_range[1]) / 2.0;
+            if (lat >= mid) {
+                hash_bytes[byte_idx] |= (1 << bit_idx);
+                lat_range[0] = mid;
+            } else {
+                lat_range[1] = mid;
+            }
+        }
+    }
+
+    for (int i = 0; i < precision; i++) {
+        int byte_idx = (i * 5) / 8;
+        int bit_offset = (i * 5) % 8;
+        uint16_t val = (hash_bytes[byte_idx] << 8);
+        if (byte_idx + 1 < (int)sizeof(hash_bytes))
+            val |= hash_bytes[byte_idx + 1];
+        val = (val >> (16 - 5 - bit_offset)) & 0x1F;
+        out[i] = BASE32[val];
+    }
+    out[precision] = '\0';
+}