feat: restore NVS runtime config with CLI commands (NVS > build-time priority)

Bring back two-layer configuration: build-time defaults from mimi_secrets.h
with runtime NVS overrides via serial CLI. NVS values take highest priority
so a pre-flashed board can be reconfigured anywhere with just a USB cable.

Restored CLI commands: wifi_set, set_tg_token, set_api_key, set_model,
set_proxy, clear_proxy, set_search_key. Added new commands: config_show
(displays all config with sensitive fields masked), config_reset (clears
all NVS overrides), and help (lists all commands).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/TODO.md

@@ -104,9 +104,9 @@
 - **MimiClaw**: Not implemented
 - **Recommendation**: Requires extra HTTPS request to Whisper API: download Telegram voice -> forward -> get text
 
-### [x] ~~Build-time Config File~~
-- Implemented: `mimi_secrets.h` — sole configuration method (build-time only, no NVS/CLI)
-- Replaces need for YAML config; suitable for MCU workflow
+### [x] ~~Build-time Config File + Runtime NVS Override~~
+- Implemented: `mimi_secrets.h` as build-time defaults, NVS as runtime override via CLI
+- Two-layer config: build-time secrets → NVS fallback, CLI commands to set/show/reset
 
 ### [ ] WebSocket Gateway Protocol Enhancement
 - **nanobot**: Gateway port 18790 + richer protocol
@@ -149,7 +149,7 @@
 - [x] OTA Update
 - [x] WiFi Manager (build-time credentials, exponential backoff)
 - [x] SPIFFS storage
-- [x] Build-time config (`mimi_secrets.h`, sole configuration method)
+- [x] Build-time config (`mimi_secrets.h`) + runtime NVS override via CLI
 
 ---