WiFi AP fallback + captive portal for offline-network reachability

[szrudi]

What

WiFi AP fallback so the Pi (hector) stays reachable when home WiFi disappears: NetworkManager broadcasts a Labelle-Printer AP, runs DHCP/NAT, and a captive portal pops the Labelle Web UI on any connecting phone.

Design + Pi-side setup are already done and manually tested; full write-up lives in docs/wifi-ap-fallback.md on the feature/wifi-ap-fallback branch.

⚠️ That branch is currently ~122 commits behind main, so its application code (captive-portal routes in server/app.py) is stale and would need rebasing/reimplementing on current main before deploy. The Pi-side networking work (below) is independent of the branch and is in place.

Done (Pi-side, on hector)

• NM AP profile Labelle-AP (SSID Labelle-Printer, 10.42.0.1, ipv4.method shared, autoconnect-priority 1 — below home WiFi's 10)
• dnsmasq DNS redirect (/etc/NetworkManager/dnsmasq-shared.d/captive-portal.conf → address=/#/10.42.0.1)
• iptables 80/443 → 5000 redirect via NM dispatcher script 90-captive-portal
• Captive-portal detection routes for iOS / Android / Windows / Firefox probe URLs (in the branch's server/app.py)
• Manual AP activation tested (nmcli con up Labelle-AP); broadcast + client connect confirmed

Remaining TODO

• Verify NM automatically falls back to AP when home WiFi disappears (only manual nmcli con up tested so far)
• End-to-end captive-portal test from a phone (browser auto-opens to the UI)
• Re-implement / rebase the captive-portal routes onto current main and deploy the updated app to hector
• Delete the stale HakhorstEU-WiFi (lowercase f) NM profile
• Change AP password off the labelleprint placeholder
• (Optional) periodic home-WiFi retry timer

Notes

This is infra/deployment-specific to the hector appliance, not a general app feature — capturing it here so the work and remaining steps aren't lost on a stale branch.