feat(mining): Bitcoin mining-for-bandwidth payment system

New modules:
- mining_payment.c/h: hashprice calc (nbits->difficulty->sat/GH/s/day),
  share validation, client stats, allotment conversion (ms + bytes)
- stratum_client.c/h: SV1 upstream pool connection (subscribe/authorize/submit)
- stratum_proxy.c/h: Local SV1 TCP server for downstream miners, job broadcast
- sw_miner.c/h: Software SHA256d miner (ESP32 CPU fallback)
- asic_miner.c/h: ASIC detection stub (BM1366/BM1368 SPI)

Config:
- config.h/c: mining_payout_mode_t enum (auto/pool/upstream/proxy_only),
  stratum pool settings, mining port, hashprice override, sandbox mint access
- Defaults fill nostr_seed_relays (8/8) and nostr_relays (4/4) with fast relays

Integration into existing modules:
- session.h/c: payment_method_t enum (CASHU/MINING/BYTES)
- firewall.h/c: firewall_set_mining_port(), firewall_set_sandbox_mint_access()
- tollgate_api.c: GET /mining/job, POST /mining/share, GET /mining/stats
- tollgate_client.h/c: TG_CLIENT_MINING state, mining discovery tag parsing
- tollgate_main.c: mining init in start_services(), stratum_client_tick() in loop
- captive_portal.c: tabbed Cashu/Mine UI with live hashrate polling

Unit tests (69 new assertions across 4 suites):
- test_mining_payment (23 tests): nbits->difficulty, hashprice, client stats, allotment
- test_stratum_proxy (21 tests): job set/get, stats, type validation
- test_session_payment_method (12 tests): PAYMENT_METHOD enum, bytes/cashu methods
- test_tollgate_client_mining (20 tests): mining tag parsing, discovery struct
- test_firewall_sandbox (16 tests): client grant/revoke, max clients, setters

Enhanced test stubs:
- BaseType_t/pdPASS in freertos/task.h
- lwip: sockets.h, etharp.h, prot/ip.h, prot/ip4.h, prot/tcp.h, netif.h
- dns_server.h, esp_wifi_ap_get_sta_list.h

Build fixes:
- cvm_server.c: replace esp_timer_get_time() with xTaskGetTickCount(),
  fix process_relay_message() 3-arg call to 2-arg, add WS keepalive ping
- stratum_proxy.c: widen task_name buffer 16->20
- sw_miner.c: add missing #include esp_random.h
- nucula_src: save_proofs() moved to public in wallet.hpp

Nostr relay updates:
- nostr_seed_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl,
  +knostr.neutrine.com, +nostr.einundzwanzig.space (8/8 slots)
- nostr_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl (4/4 slots)

Squash-merge of feature/mining-payment (5 commits: c75230e..9d98ba1)

1 files changed, 112 insertions, 0 deletions

diff --git a/main/sw_miner.c b/main/sw_miner.c
new file mode 100644
index 0000000..cdd98a0
--- /dev/null
+++ b/main/sw_miner.c
@@ -0,0 +1,112 @@
+#include "sw_miner.h"
+#include "stratum_proxy.h"
+#include "stratum_client.h"
+#include "mining_payment.h"
+#include "config.h"
+#include "esp_log.h"
+#include "esp_random.h"
+#include "mbedtls/sha256.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+
+static const char *TAG = "sw_miner";
+static bool s_running = false;
+static TaskHandle_t s_task_handle = NULL;
+static double s_hashrate = 0.0;
+
+static void sha256d(const uint8_t *data, size_t len, uint8_t *hash)
+{
+    uint8_t tmp[32];
+    mbedtls_sha256(data, len, tmp, 0);
+    mbedtls_sha256(tmp, 32, hash, 0);
+}
+
+static void sw_miner_task(void *arg)
+{
+    ESP_LOGI(TAG, "Software miner started");
+
+    uint64_t hashes = 0;
+    int64_t start_time = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+
+    uint8_t header[80];
+    uint8_t hash[32];
+
+    while (s_running) {
+        const stratum_job_t *job = stratum_proxy_get_current_job();
+        if (!job || !job->valid) {
+            vTaskDelay(pdMS_TO_TICKS(1000));
+            continue;
+        }
+
+        stratum_job_t local_job;
+        memcpy(&local_job, job, sizeof(stratum_job_t));
+
+        memcpy(header, local_job.prevhash, 32);
+        memcpy(header + 32, local_job.merkle_root, 32);
+
+        uint32_t start_nonce = esp_random();
+        uint32_t end_nonce = start_nonce + 1000;
+
+        for (uint32_t nonce = start_nonce; nonce < end_nonce && s_running; nonce++) {
+            header[76] = (nonce >> 0) & 0xFF;
+            header[77] = (nonce >> 8) & 0xFF;
+            header[78] = (nonce >> 16) & 0xFF;
+            header[79] = (nonce >> 24) & 0xFF;
+
+            sha256d(header, 80, hash);
+            hashes++;
+
+            if (memcmp(hash, local_job.target, local_job.target_len) <= 0) {
+                ESP_LOGI(TAG, "Valid share found! nonce=%08lx", (unsigned long)nonce);
+                stratum_client_submit_share(local_job.job_id, nonce, local_job.ntime, local_job.version);
+                mining_update_hashrate(0, true);
+                break;
+            }
+        }
+
+        int64_t now = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+        int64_t elapsed_s = (now - start_time) / 1000;
+        if (elapsed_s > 0) {
+            s_hashrate = (double)hashes / (double)elapsed_s / 1e6;
+        }
+
+        taskYIELD();
+    }
+
+    vTaskDelete(NULL);
+}
+
+esp_err_t sw_miner_start(void)
+{
+    if (s_running) return ESP_OK;
+    s_running = true;
+    s_hashrate = 0.0;
+
+    BaseType_t ret = xTaskCreate(sw_miner_task, "sw_miner", 8192, NULL, 2, &s_task_handle);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create sw_miner task");
+        s_running = false;
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+void sw_miner_stop(void)
+{
+    s_running = false;
+    if (s_task_handle) {
+        vTaskDelay(pdMS_TO_TICKS(500));
+        s_task_handle = NULL;
+    }
+}
+
+bool sw_miner_is_running(void)
+{
+    return s_running;
+}
+
+double sw_miner_get_hashrate(void)
+{
+    return s_hashrate;
+}