feat: WPA auto-detect, STA connectivity fix, lwip crash fix

- Add wifi_auth_mode config field (WPA2/WPA3) parsed from config.json
- Default to WPA2 (accepts both WPA2 and WPA3 networks)
- Replace hardcoded WIFI_AUTH_WPA3_PSK with runtime threshold mapping
- Reduce MINT_HEALTH_PROBE_INTERVAL_S from 300 to 30 for testing
- Add 3s delay before service start + 5s DNS stabilization for health probes
- Fixes lwip mem_free crash caused by concurrent HTTP at boot

Verified on hardware:
- STA connects to WPA2 home router (Got IP:192.168.2.16)
- All 4 mint health probes complete successfully
- API endpoints return correct data with reachable mint filtering
- 4/4 wallets initialized with real keysets from live mints

5 files changed, 19 insertions, 3 deletions

diff --git a/main/config.c b/main/config.c
index 54642a2..fe0ceba 100644
--- a/main/config.c
+++ b/main/config.c
@@ -35,6 +35,7 @@ esp_err_t tollgate_config_init(void)
     g_config.payout.mint_count = 0;
     g_config.cvm_enabled = true;
     strncpy(g_config.cvm_relays, "wss://relay.primal.net", sizeof(g_config.cvm_relays) - 1);
+    strncpy(g_config.wifi_auth_mode, "WPA2", sizeof(g_config.wifi_auth_mode) - 1);
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -272,6 +273,11 @@ esp_err_t tollgate_config_init(void)
         }
     }
 
+    cJSON *auth_mode = cJSON_GetObjectItem(root, "wifi_auth_mode");
+    if (auth_mode && cJSON_IsString(auth_mode)) {
+        strncpy(g_config.wifi_auth_mode, auth_mode->valuestring, sizeof(g_config.wifi_auth_mode) - 1);
+    }
+
     if (g_config.payout.mint_count == 0 && g_config.mint_url[0] != '\0') {
         strncpy(g_config.payout.mints[0].url, g_config.mint_url,
                 sizeof(g_config.payout.mints[0].url) - 1);
@@ -319,7 +325,13 @@ esp_err_t tollgate_config_get_wifi(wifi_config_t *wifi_config)
     memset(wifi_config, 0, sizeof(wifi_config_t));
     strncpy((char *)wifi_config->sta.ssid, g_config.networks[idx].ssid, sizeof(wifi_config->sta.ssid) - 1);
     strncpy((char *)wifi_config->sta.password, g_config.networks[idx].password, sizeof(wifi_config->sta.password) - 1);
-    wifi_config->sta.threshold.authmode = WIFI_AUTH_WPA3_PSK;
+    wifi_config->sta.threshold.authmode = WIFI_AUTH_WPA2_PSK;
+    if (strstr(g_config.wifi_auth_mode, "WPA3")) {
+        wifi_config->sta.threshold.authmode = WIFI_AUTH_WPA3_PSK;
+    } else if (strstr(g_config.wifi_auth_mode, "WPA2")) {
+        wifi_config->sta.threshold.authmode = WIFI_AUTH_WPA2_PSK;
+    }
+    ESP_LOGI(TAG, "STA auth threshold: %s → %d", g_config.wifi_auth_mode, wifi_config->sta.threshold.authmode);
     return ESP_OK;
 }
 
diff --git a/main/config.h b/main/config.h
index 8e12878..1a32cc2 100644
--- a/main/config.h
+++ b/main/config.h
@@ -65,6 +65,8 @@ typedef struct {
 
     bool cvm_enabled;
     char cvm_relays[256];
+
+    char wifi_auth_mode[16];
 } tollgate_config_t;
 
 void tollgate_config_derive_unique(tollgate_config_t *cfg);
diff --git a/main/mint_health.c b/main/mint_health.c
index 39b0e8e..5853a39 100644
--- a/main/mint_health.c
+++ b/main/mint_health.c
@@ -155,7 +155,8 @@ static void run_initial_probes(void)
 
 static void health_task(void *pvParameters)
 {
-    ESP_LOGI(TAG, "Health probe task started");
+    ESP_LOGI(TAG, "Health probe task started, waiting for DNS to stabilize...");
+    vTaskDelay(pdMS_TO_TICKS(5000));
     run_initial_probes();
 
     while (s_running) {
diff --git a/main/mint_health.h b/main/mint_health.h
index f047d6a..4e9a5a7 100644
--- a/main/mint_health.h
+++ b/main/mint_health.h
@@ -6,7 +6,7 @@
 #include <stdbool.h>
 
 #define MINT_HEALTH_MAX             8
-#define MINT_HEALTH_PROBE_INTERVAL_S  300
+#define MINT_HEALTH_PROBE_INTERVAL_S  30
 #define MINT_HEALTH_PROBE_TIMEOUT_MS  15000
 #define MINT_HEALTH_RECOVERY_THRESHOLD 3
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index a39ccc9..228d8ef 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -84,6 +84,7 @@ static void wifi_event_handler(void *arg, esp_event_base_t event_base,
 
 static void services_start_task(void *pvParameters)
 {
+    vTaskDelay(pdMS_TO_TICKS(3000));
     start_services();
     vTaskDelete(NULL);
 }