[BUG] Validate configuration before startup

[EdwardChamberlain]

Summary

• Validate ESP32-C3 GPIO pins against the shipped MicroPython pin table; invalid active and backup configuration falls back to safe settings.
• Limit blocking API request timeouts to 10 seconds, below the 60-second watchdog budget.
• Apply the 64-digit hexadecimal password exception only to station Wi-Fi; enforce the access point's 63-byte limit.
• Keep OTA downloads at the 96 KiB limit understood by installed v1 loaders, while allowing UI files up to 36 KiB. Release validation uses the same limit.
• Add regression coverage for unsupported pins, configuration recovery, timeout bounds, password boundaries, and maximum-size UI OTA bundles.

Validation

CI run 38358972775 passed the quality gate and Windows/macOS desktop smoke jobs. Local git diff --check and Python syntax checks also passed. Hardware tests were not repeated.

Closes #47

[EdwardChamberlain]

Review of 930fd8746db9c98a0fe6c966b06f993e516af6eb: changes required before merge.

1. [P1] Reject GPIOs that the shipped ESP32-C3 firmware cannot construct — micro/config_loader.py:79–81 accepts every integer from 0 through 21. Both validate_config({'led': {'pin': 14}}) and validate_config({'button': {'pin': 17}}) succeed, and loading preserves those settings. MicroPython v1.28.0's C3 pin table omits GPIO14–17; machine.Pin raises ValueError('invalid pin') for them. LED/button construction runs before Wi-Fi and the web server, so the original no-setup boot failure remains reachable. Use the supported board/firmware pin set and test invalid-pin backup/default recovery against a constructor that rejects unavailable pins. Sources: C3 pin availability, Pin constructor validation.

2. [P2] Bound API timeouts by the watchdog budget — micro/config_loader.py:77 accepts a 120-second request timeout, but app_main.py starts a 60-second watchdog. API.api_get/api_post pass the configured timeout into a blocking request, and the watchdog is not fed while that request is blocked. A slow/unresponsive API can therefore repeatedly reset the board before the first loop confirms boot, or starve setup access after boot. Set a timeout budget below the watchdog and cover this relationship in validation tests.

3. [P2] Keep the release size gate compatible with installed bootloaders — increasing micro/ota_manager.py:69 to 104 KiB only changes new USB installs: ota_manager.py is deliberately excluded from OTA APP_FILES, while generated bundles still declare minimum_bootloader: 1. Existing main installations retain the 96 KiB root downloader/upload cap. I reproduced a 102,631-byte maximum-UI bundle accepted by the new release validator but rejected by the main downloader with OTAError: Update bundle payload is too large. Validate against the oldest supported installed loader, or introduce an explicit versioned loader-upgrade/migration requirement before allowing assets above 96 KiB.

4. [P2] Separate station PSK and access-point password validation — micro/config_loader.py:255–265 permits a 64-digit hex key for wifi.ap_password. The shipped MicroPython AP setter copies at most 63 bytes, silently changing that accepted key. Reject 64-byte AP passwords and retain the 64-digit exception only where the station driver supports it. Cover AP-password boundary values. Source: MicroPython AP password setter.

Verification: 81 focused configuration/startup/GUI/web/OTA validation tests passed locally with a FreeSimpleGUI import shim, and current CI is green. The findings above come from additional boundary probes and the exact shipped MicroPython source; physical hardware tests were not repeated.

[EdwardChamberlain]

Implemented the four review fixes in head 8dc75575b1e78452293ad96b8dbda4d70bae9e6c.

• Configuration now permits only GPIOs 0–13 and 20–21 from the shipped ESP32-C3 firmware pin table. Invalid active values recover through the existing backup/default path.
• API timeouts are capped at 10 seconds against the 60-second watchdog.
• A 64-digit hexadecimal PSK remains valid for station Wi-Fi; AP passwords are limited to 63 bytes.
• OTA payloads remain compatible with installed v1 loaders at 96 KiB. UI files may grow to 36 KiB, and the maximum-size bundle is checked by release validation.

Regression cases cover these boundaries and recovery. CI run 38358972775 passed the quality gate and both desktop smoke jobs. No hardware tests were repeated.