feat(mining): Bitcoin mining-for-bandwidth payment system

New modules:
- mining_payment.c/h: hashprice calc (nbits->difficulty->sat/GH/s/day),
  share validation, client stats, allotment conversion (ms + bytes)
- stratum_client.c/h: SV1 upstream pool connection (subscribe/authorize/submit)
- stratum_proxy.c/h: Local SV1 TCP server for downstream miners, job broadcast
- sw_miner.c/h: Software SHA256d miner (ESP32 CPU fallback)
- asic_miner.c/h: ASIC detection stub (BM1366/BM1368 SPI)

Config:
- config.h/c: mining_payout_mode_t enum (auto/pool/upstream/proxy_only),
  stratum pool settings, mining port, hashprice override, sandbox mint access
- Defaults fill nostr_seed_relays (8/8) and nostr_relays (4/4) with fast relays

Integration into existing modules:
- session.h/c: payment_method_t enum (CASHU/MINING/BYTES)
- firewall.h/c: firewall_set_mining_port(), firewall_set_sandbox_mint_access()
- tollgate_api.c: GET /mining/job, POST /mining/share, GET /mining/stats
- tollgate_client.h/c: TG_CLIENT_MINING state, mining discovery tag parsing
- tollgate_main.c: mining init in start_services(), stratum_client_tick() in loop
- captive_portal.c: tabbed Cashu/Mine UI with live hashrate polling

Unit tests (69 new assertions across 4 suites):
- test_mining_payment (23 tests): nbits->difficulty, hashprice, client stats, allotment
- test_stratum_proxy (21 tests): job set/get, stats, type validation
- test_session_payment_method (12 tests): PAYMENT_METHOD enum, bytes/cashu methods
- test_tollgate_client_mining (20 tests): mining tag parsing, discovery struct
- test_firewall_sandbox (16 tests): client grant/revoke, max clients, setters

Enhanced test stubs:
- BaseType_t/pdPASS in freertos/task.h
- lwip: sockets.h, etharp.h, prot/ip.h, prot/ip4.h, prot/tcp.h, netif.h
- dns_server.h, esp_wifi_ap_get_sta_list.h

Build fixes:
- cvm_server.c: replace esp_timer_get_time() with xTaskGetTickCount(),
  fix process_relay_message() 3-arg call to 2-arg, add WS keepalive ping
- stratum_proxy.c: widen task_name buffer 16->20
- sw_miner.c: add missing #include esp_random.h
- nucula_src: save_proofs() moved to public in wallet.hpp

Nostr relay updates:
- nostr_seed_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl,
  +knostr.neutrine.com, +nostr.einundzwanzig.space (8/8 slots)
- nostr_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl (4/4 slots)

Squash-merge of feature/mining-payment (5 commits: c75230e..9d98ba1)

1 files changed, 74 insertions, 0 deletions

diff --git a/tests/unit/test_session_payment_method.c b/tests/unit/test_session_payment_method.c
new file mode 100644
index 0000000..0239140
--- /dev/null
+++ b/tests/unit/test_session_payment_method.c
@@ -0,0 +1,74 @@
+#include "test_framework.h"
+#include "../../main/session.h"
+#include "../../main/firewall.h"
+#include "../../main/config.h"
+#include "../../main/cashu.h"
+#include <string.h>
+#include <stdio.h>
+
+static tollgate_config_t g_test_config;
+
+const tollgate_config_t *tollgate_config_get(void) {
+    return &g_test_config;
+}
+
+esp_err_t firewall_get_mac_for_ip(uint32_t ip, char *mac_out, size_t size) {
+    (void)ip;
+    snprintf(mac_out, size, "AA:BB:CC:DD:EE:FF");
+    return 0;
+}
+
+static uint32_t g_granted_ips[32];
+static int g_granted_count = 0;
+
+void firewall_grant_access(uint32_t ip) {
+    if (g_granted_count < 32) g_granted_ips[g_granted_count++] = ip;
+}
+
+void firewall_revoke_access(uint32_t ip) {
+    (void)ip;
+}
+
+int main(void)
+{
+    printf("=== test_session_payment_method ===\n");
+    memset(&g_test_config, 0, sizeof(g_test_config));
+    strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
+    g_granted_count = 0;
+
+    printf("\n--- session_create sets PAYMENT_METHOD_CASHU ---\n");
+    session_manager_init();
+    session_t *s1 = session_create(0x0A010001, 60000);
+    ASSERT(s1 != NULL, "session created");
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s1->payment_method, "cashu session has PAYMENT_METHOD_CASHU");
+
+    printf("\n--- session_create_bytes sets PAYMENT_METHOD_BYTES ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s2 = session_create_bytes(0x0A010002, 1048576);
+    ASSERT(s2 != NULL, "bytes session created");
+    ASSERT_EQ_INT(PAYMENT_METHOD_BYTES, (int)s2->payment_method, "bytes session has PAYMENT_METHOD_BYTES");
+    ASSERT_EQ_UINT64(1048576, s2->allotment_bytes, "allotment_bytes set");
+    ASSERT_EQ_UINT64(0, s2->bytes_consumed, "bytes_consumed starts at 0");
+
+    printf("\n--- payment_method_t enum values are distinct ---\n");
+    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_MINING, "CASHU != MINING");
+    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_BYTES, "CASHU != BYTES");
+    ASSERT(PAYMENT_METHOD_MINING != PAYMENT_METHOD_BYTES, "MINING != BYTES");
+
+    printf("\n--- session extend preserves payment_method ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s3 = session_create(0x0A010003, 60000);
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "initially CASHU");
+    session_extend(s3, 30000);
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "still CASHU after extend");
+
+    printf("\n--- bytes session allotment_ms is INT64_MAX ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s4 = session_create_bytes(0x0A010004, 2097152);
+    ASSERT(s4->allotment_ms == INT64_MAX, "bytes session has INT64_MAX allotment_ms");
+
+    TEST_SUMMARY();
+}