feat: restore NVS runtime config with CLI commands (NVS > build-time priority)

Bring back two-layer configuration: build-time defaults from mimi_secrets.h
with runtime NVS overrides via serial CLI. NVS values take highest priority
so a pre-flashed board can be reconfigured anywhere with just a USB cable.

Restored CLI commands: wifi_set, set_tg_token, set_api_key, set_model,
set_proxy, clear_proxy, set_search_key. Added new commands: config_show
(displays all config with sensitive fields masked), config_reset (clears
all NVS overrides), and help (lists all commands).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

main/wifi/wifi_manager.c

@@ -6,6 +6,8 @@
 #include "esp_log.h"
 #include "esp_wifi.h"
 #include "esp_netif.h"
+#include "nvs_flash.h"
+#include "nvs.h"
 
 static const char *TAG = "wifi";
 
@@ -70,14 +72,34 @@ esp_err_t wifi_manager_init(void)
 
 esp_err_t wifi_manager_start(void)
 {
-    if (MIMI_SECRET_WIFI_SSID[0] == '\0') {
-        ESP_LOGW(TAG, "No WiFi credentials. Set MIMI_SECRET_WIFI_SSID in mimi_secrets.h");
-        return ESP_ERR_NOT_FOUND;
+    wifi_config_t wifi_cfg = {0};
+    bool found = false;
+
+    /* NVS overrides take highest priority (set via CLI) */
+    nvs_handle_t nvs;
+    if (nvs_open(MIMI_NVS_WIFI, NVS_READONLY, &nvs) == ESP_OK) {
+        size_t len = sizeof(wifi_cfg.sta.ssid);
+        if (nvs_get_str(nvs, MIMI_NVS_KEY_SSID, (char *)wifi_cfg.sta.ssid, &len) == ESP_OK) {
+            len = sizeof(wifi_cfg.sta.password);
+            nvs_get_str(nvs, MIMI_NVS_KEY_PASS, (char *)wifi_cfg.sta.password, &len);
+            found = true;
+        }
+        nvs_close(nvs);
     }
 
-    wifi_config_t wifi_cfg = {0};
-    strncpy((char *)wifi_cfg.sta.ssid, MIMI_SECRET_WIFI_SSID, sizeof(wifi_cfg.sta.ssid) - 1);
-    strncpy((char *)wifi_cfg.sta.password, MIMI_SECRET_WIFI_PASS, sizeof(wifi_cfg.sta.password) - 1);
+    /* Fall back to build-time secrets */
+    if (!found) {
+        if (MIMI_SECRET_WIFI_SSID[0] != '\0') {
+            strncpy((char *)wifi_cfg.sta.ssid, MIMI_SECRET_WIFI_SSID, sizeof(wifi_cfg.sta.ssid) - 1);
+            strncpy((char *)wifi_cfg.sta.password, MIMI_SECRET_WIFI_PASS, sizeof(wifi_cfg.sta.password) - 1);
+            found = true;
+        }
+    }
+
+    if (!found) {
+        ESP_LOGW(TAG, "No WiFi credentials. Use CLI: wifi_set <SSID> <PASS>");
+        return ESP_ERR_NOT_FOUND;
+    }
 
     ESP_LOGI(TAG, "Connecting to SSID: %s", wifi_cfg.sta.ssid);
 
@@ -110,6 +132,18 @@ const char *wifi_manager_get_ip(void)
     return s_ip_str;
 }
 
+esp_err_t wifi_manager_set_credentials(const char *ssid, const char *password)
+{
+    nvs_handle_t nvs;
+    ESP_ERROR_CHECK(nvs_open(MIMI_NVS_WIFI, NVS_READWRITE, &nvs));
+    ESP_ERROR_CHECK(nvs_set_str(nvs, MIMI_NVS_KEY_SSID, ssid));
+    ESP_ERROR_CHECK(nvs_set_str(nvs, MIMI_NVS_KEY_PASS, password));
+    ESP_ERROR_CHECK(nvs_commit(nvs));
+    nvs_close(nvs);
+    ESP_LOGI(TAG, "WiFi credentials saved for SSID: %s", ssid);
+    return ESP_OK;
+}
+
 EventGroupHandle_t wifi_manager_get_event_group(void)
 {
     return s_wifi_event_group;

main/wifi/wifi_manager.h

@@ -35,6 +35,11 @@ bool wifi_manager_is_connected(void);
  */
 const char *wifi_manager_get_ip(void);
 
+/**
+ * Save WiFi credentials to NVS.
+ */
+esp_err_t wifi_manager_set_credentials(const char *ssid, const char *password);
+
 /**
  * Get the event group for WiFi state (WIFI_CONNECTED_BIT / WIFI_FAIL_BIT).
  */