Add BLE Wi-Fi provisioning alongside the setup SoftAP

Wraps ESP-IDF's official wifi_provisioning manager (BLE transport,
protocomm Security1, NimBLE host) so a phone can join the device to
Wi-Fi over the ESP32-S3's own onboard BLE radio, without first
connecting to the 192.168.4.1 SoftAP. Chosen over a custom GATT
service specifically so the existing generic "ESP BLE Provisioning"
iOS/Android apps work today, before the dedicated DigiRadio app
exists — same standard protocol either app would speak.

net::ble_provisioning::start() is additive, not a replacement: it
runs next to the current SoftAP + POST /api/wifi HTTP route inside
NetBootstrap's startSetupMode(), and failing to start it is
non-fatal (same pattern already used there for the SigmaStudio TCP
bridge) — SoftAP setup keeps working either way. Proof-of-possession
is the device's own serial number (same source as the SoftAP SSID),
so pairing requires reading it off the unit rather than being wide
open. On WIFI_PROV_CRED_SUCCESS the received wifi_sta_config_t is
converted to the same core::WifiCredentials type the HTTP handler
uses and saved through the same ISecureStore, then the device
reboots into STA mode — one persistence path regardless of which
transport provisioned it.

BT1035 is unaffected: it's a separate UART-attached classic
Bluetooth module for A2DP output. This uses the ESP32-S3's
independent internal BLE controller, switched to NimBLE (smaller
footprint than Bluedroid, the only host stack needed for a single
peripheral-role GATT service). App binary still has 33% free flash
after pulling in wifi_provisioning/protocomm/NimBLE.

Verified: idf.py build, doxygen (0 warnings), check-manual-sync,
check_si4684_blobs, ctest (19/19) all green. Not yet tested with a
real BLE provisioning app or on hardware — board is disconnected
this session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178rASQ6ZETPMUamvpoR2KR

Software/components/net/include/net/BleProvisioning.hpp

@@ -0,0 +1,50 @@
+/**
+ * @file    BleProvisioning.hpp
+ * @brief   BLE GATT Wi-Fi provisioning, additive alongside the setup SoftAP.
+ *
+ * DigiRadio firmware — https://github.com/manvalan/DigiRadio
+ *
+ * Copyright 2026 Michele Bigi
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * @author  Michele Bigi
+ * @date    2026-08-18
+ */
+#pragma once
+
+#include "core/DeviceIdentity.hpp"
+#include "core/ISecureStore.hpp"
+#include "net/NetError.hpp"
+
+#include <expected>
+
+namespace net::ble_provisioning {
+
+/**
+ * @brief    start — start the ESP-IDF wifi_provisioning manager over BLE.
+ *
+ * @dname    start
+ * @param    store           Secure store the received credentials are saved
+ *                            to (same store POST /api/wifi writes to).
+ * @param    deviceIdentity  Supplies the BLE advertising name (softApSsid)
+ *                            and the proof-of-possession string (serialNumber).
+ * @return   Ok once provisioning is advertising, or NetError::BleProvisioningFailed.
+ * @pubstate Starts the onboard ESP32-S3 BLE radio (independent of the BT1035
+ *           UART module) and a process-lifetime wifi_provisioning manager
+ *           singleton. On a successful join, saves credentials to store and
+ *           reboots, mirroring wifiPostHandler's POST /api/wifi behaviour.
+ *           Runs alongside the existing SoftAP + HTTP provisioning route,
+ *           not instead of it — either path can complete setup.
+ *
+ * @author   Michele Bigi
+ * @date     2026-08-18
+ */
+[[nodiscard]] std::expected<void, NetError>
+start(core::ISecureStore& store, const core::DeviceIdentity& deviceIdentity);
+
+} // namespace net::ble_provisioning

Software/components/net/include/net/NetError.hpp

@@ -43,6 +43,7 @@ enum class NetError {
     StoreSaveFailed,
     CredentialsNotFound,
     WifiScanFailed,
+    BleProvisioningFailed,
 };
 
 } // namespace net