Enable NVS and flash encryption at rest (fw 0.8.3).

Add initEncryptedStorage, development-mode Kconfig defaults, production overlay, and security HIL docs; wire NetBootstrap through encrypted NVS bring-up.

Co-authored-by: Cursor <cursoragent@cursor.com>

Software/docs/manual/ch-api.tex

@@ -36,7 +36,7 @@ Returns a health-check DTO serialised by
 
 \begin{drnote}[Response schema]
 \begin{drcode}[JSON]
-{"status":"ok","fw":"0.8.2",
+{"status":"ok","fw":"0.8.3",
  "chips":{"si4684":true,"adau1701":true,"bt1035":true}}
 \end{drcode}
 \begin{itemize}
@@ -354,8 +354,10 @@ as \texttt{last\_preset} (u8). Passwords are wrapped in
 \texttt{core::Secret} in RAM and are never logged or returned by the API.
 
 \begin{drcaution}[Encryption at rest]
-Development builds use plain NVS. Production should enable NVS encryption
-using the reserved \texttt{nvs\_keys} partition (see
-\texttt{partitions.csv} and \texttt{sdkconfig.defaults} comments) per
-current ESP-IDF security guidance.
+Firmware~0.8.3+ enables NVS encryption (\texttt{CONFIG\_NVS\_ENCRYPTION}) and
+flash encryption in development mode (\texttt{sdkconfig.defaults}). Keys live in
+the \texttt{nvs\_keys} partition; Wi-Fi passwords remain wrapped in
+\texttt{core::Secret} in RAM and are never logged. First upgrade from plain NVS
+requires \texttt{idf.py erase-flash}. HIL checklist:
+\texttt{Software/docs/security-flash-nvs.md}.
 \end{drcaution}

Software/docs/manual/ch-classes.tex

@@ -99,8 +99,9 @@ RAII STA join helper with an explicit connect timeout. Assumes
 
 \section{NvsSecureStore}\label{cls:NvsSecureStore}
 \texttt{ISecureStore} implementation backed by an NVS namespace. Passwords
-are stored as NVS strings and never logged. Production should enable NVS
-encryption using the reserved \texttt{nvs\_keys} partition.
+are stored as NVS strings and never logged. NVS encryption and flash
+encryption are enabled in \texttt{sdkconfig.defaults}; initialisation runs in
+\texttt{secure\_store::initEncryptedStorage()} before network bring-up.
 
 % ------------------------------------------------------------------
 % Hardware drivers (Slice 3)

Software/docs/manual/ch-firmware.tex

@@ -180,8 +180,9 @@ Chapter~\ref{ch:api}.
 Sensitive data --- Wi-Fi credentials today; user credentials and the
 station/frequency list in later slices --- uses \texttt{core::Secret} so
 values cannot be logged or implicitly converted to a string; buffers are
-cleared on destruction. Production builds should enable NVS encryption
-at rest (see Chapter~\ref{sec:api-storage}).
+cleared on destruction. Firmware~0.8.3+ enables NVS and flash encryption at
+rest via \texttt{secure\_store::initEncryptedStorage()} (see
+\texttt{docs/security-flash-nvs.md} and Chapter~\ref{sec:api-storage}).
 
 \section{Companion-chip boot at power-up}
 \label{sec:fw-chip-boot}