fix: TLS allocation, stack overflow, DNS bind — mint now reachable

Root cause: mbedtls SSL buffers (16KB) couldn't allocate from fragmented
internal RAM (largest block 8KB). Fix by lowering SPIRAM_MALLOC_ALWAYSINTERNAL
from 16KB to 4KB, allowing SSL buffers to go to PSRAM.

Additional fixes:
- DNS server binds to AP IP only (prevents self-hijacking)
- start_services() moved from esp_timer (2KB stack) to dedicated FreeRTOS
  task (16KB stack) — was causing stack overflow with dynamic buffers
- Mint health probe now logs errors and exposes last_err in API
- Debug endpoint shows internal/PSRAM heap breakdown and DNS resolve test
- Enabled CONFIG_MBEDTLS_DYNAMIC_BUFFER for better memory management
- Board C config: mint_url → testnut-nutshell.mints.orangesync.tech

1 files changed, 3 insertions, 3 deletions

diff --git a/sdkconfig b/sdkconfig
index 75f2a12..9ba9857 100644
--- a/sdkconfig
+++ b/sdkconfig
@@ -1095,7 +1095,7 @@ CONFIG_SPIRAM_BOOT_INIT=y
 # CONFIG_SPIRAM_USE_CAPS_ALLOC is not set
 CONFIG_SPIRAM_USE_MALLOC=y
 CONFIG_SPIRAM_MEMTEST=y
-CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=16384
+CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=4096
 # CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP is not set
 CONFIG_SPIRAM_MALLOC_RESERVE_INTERNAL=32768
 # CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY is not set
@@ -1682,13 +1682,13 @@ CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC=y
 CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y
 CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
-# CONFIG_MBEDTLS_DYNAMIC_BUFFER is not set
+CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+# CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA is not set
 # CONFIG_MBEDTLS_DEBUG is not set
 
 #
 # mbedTLS v3.x related
 #
-# CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 is not set
 # CONFIG_MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH is not set
 # CONFIG_MBEDTLS_X509_TRUSTED_CERT_CALLBACK is not set
 # CONFIG_MBEDTLS_SSL_CONTEXT_SERIALIZATION is not set