Phase 7: MCP handler (25 tests), NIP-04 encrypt/decrypt (15 tests), CVM server skeleton

- mcp_handler.c/h: 4 tools (get_config, set_config, get_balance, wallet_send)
- nip04.c/h: AES-256-CBC + ECDH with 0x02 compressed pubkey prefix
  - Fixed IV copy bug: mbedTLS AES-CBC modifies IV in-place
  - Base64 encode/decode for ciphertext transport
  - PKCS7 padding
- cvm_server.c/h: Nostr DM listener with FreeRTOS task
- config: cvm_enabled, cvm_relays fields
- 156 total tests passing across 10 test binaries

1 files changed, 8 insertions, 0 deletions

diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 3f83923..6adb0ec 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -21,6 +21,7 @@
 #include "wifistr.h"
 #include "tollgate_client.h"
 #include "lightning_payout.h"
+#include "cvm_server.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -146,6 +147,12 @@ static void start_services(void)
 
     xTaskCreate(publish_wifistr_task, "wifistr_init", 16384, NULL, 3, NULL);
 
+    const tollgate_config_t *cfg2 = tollgate_config_get();
+    if (cfg2->cvm_enabled) {
+        cvm_server_init();
+        cvm_server_start();
+    }
+
     s_services_running = true;
     if (s_services_mutex) xSemaphoreGive(s_services_mutex);
     ESP_LOGI(TAG, "=== TollGate services started ===");
@@ -162,6 +169,7 @@ static void stop_services(void)
     captive_portal_stop();
     tollgate_api_stop();
     dns_server_stop();
+    cvm_server_stop();
     firewall_disable_nat();
     firewall_revoke_all();
     s_services_running = false;