feat: per-client NAT filtering via LWIP_HOOK_IP4_CANFORWARD

- Add lwip_tollgate_hooks.h defining LWIP_HOOK_IP4_CANFORWARD macro
- Inject hook into lwIP build via CMakeLists.txt ESP_IDF_LWIP_HOOK_FILENAME
- Filter forwarded packets by source IP against firewall allowed list
- Only filter packets from AP subnet (10.192.45.0/24), allow all others
- Fix byte order bug: use network byte order for firewall_is_client_allowed
- NAT always enabled, removed global NAT toggle functions
- Remove spent-secret tracking from session.c (mint is authority)
- Remove unused get_ap_netif() function
- Reduce API server stack from 32KB to 16KB (fixes ESP_ERR_HTTPD_TASK)
- Add esp_random.h stub for unit tests
- All 186 unit tests passing
- Verified on hardware: block->pay->allow->revoke->block E2E works

1 files changed, 3 insertions, 45 deletions

diff --git a/main/session.c b/main/session.c
index 4854163..9b4380c 100644
--- a/main/session.c
+++ b/main/session.c
@@ -7,15 +7,10 @@
 #include "freertos/task.h"
 #include <string.h>
 
-#define SPENT_SECRETS_MAX 100
-
 static const char *TAG = "session";
 static session_t s_sessions[SESSION_MAX_CLIENTS];
 static int s_session_count = 0;
 
-static char s_spent_secrets[SPENT_SECRETS_MAX][65];
-static int s_spent_count = 0;
-
 static int64_t get_time_ms(void)
 {
     return (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
@@ -25,7 +20,6 @@ esp_err_t session_manager_init(void)
 {
     memset(s_sessions, 0, sizeof(s_sessions));
     s_session_count = 0;
-    s_spent_count = 0;
     ESP_LOGI(TAG, "Session manager initialized");
     return ESP_OK;
 }
@@ -37,27 +31,14 @@ static void populate_mac(session_t *session, uint32_t client_ip)
     }
 }
 
-session_t *session_create(uint32_t client_ip, uint64_t allotment_ms,
-                          const char *spent_secrets[], int secret_count)
+session_t *session_create(uint32_t client_ip, uint64_t allotment_ms)
 {
     session_t *existing = session_find_by_ip(client_ip);
     if (existing) {
         session_extend(existing, allotment_ms);
-        for (int i = 0; i < secret_count && s_spent_count < SPENT_SECRETS_MAX; i++) {
-            strncpy(s_spent_secrets[s_spent_count], spent_secrets[i], 64);
-            s_spent_secrets[s_spent_count][64] = '\0';
-            s_spent_count++;
-        }
         return existing;
     }
 
-    for (int i = 0; i < secret_count; i++) {
-        if (session_is_secret_spent(spent_secrets[i])) {
-            ESP_LOGW(TAG, "Duplicate secret rejected");
-            return NULL;
-        }
-    }
-
     if (s_session_count >= SESSION_MAX_CLIENTS) {
         for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
             if (!s_sessions[i].active || session_is_expired(&s_sessions[i])) {
@@ -73,22 +54,8 @@ session_t *session_create(uint32_t client_ip, uint64_t allotment_ms,
             s_sessions[i].allotment_ms = allotment_ms;
             s_sessions[i].start_time_ms = get_time_ms();
             s_sessions[i].active = true;
-            s_sessions[i].spent_secret_count = 0;
             populate_mac(&s_sessions[i], client_ip);
 
-            for (int j = 0; j < secret_count && j < 5; j++) {
-                strncpy(s_sessions[i].spent_secrets[s_sessions[i].spent_secret_count],
-                        spent_secrets[j], 64);
-                s_sessions[i].spent_secrets[s_sessions[i].spent_secret_count][64] = '\0';
-                s_sessions[i].spent_secret_count++;
-            }
-
-            for (int j = 0; j < secret_count && s_spent_count < SPENT_SECRETS_MAX; j++) {
-                strncpy(s_spent_secrets[s_spent_count], spent_secrets[j], 64);
-                s_spent_secrets[s_spent_count][64] = '\0';
-                s_spent_count++;
-            }
-
             s_session_count++;
             firewall_grant_access(client_ip);
 
@@ -104,10 +71,9 @@ session_t *session_create(uint32_t client_ip, uint64_t allotment_ms,
     return NULL;
 }
 
-session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes,
-                                const char *spent_secrets[], int secret_count)
+session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes)
 {
-    session_t *s = session_create(client_ip, 0, spent_secrets, secret_count);
+    session_t *s = session_create(client_ip, 0);
     if (s) {
         s->allotment_bytes = allotment_bytes;
         s->bytes_consumed = 0;
@@ -170,14 +136,6 @@ bool session_is_expired(const session_t *session)
     return elapsed >= (int64_t)session->allotment_ms;
 }
 
-bool session_is_secret_spent(const char *secret)
-{
-    for (int i = 0; i < s_spent_count; i++) {
-        if (strncmp(s_spent_secrets[i], secret, 64) == 0) return true;
-    }
-    return false;
-}
-
 void session_check_expiry(void)
 {
     for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {