Add secure first-boot provisioning

[sraodev]

Summary

• replace checked-in shared credentials with a one-time, local first-boot provisioning flow
• generate a device-unique 256-bit JWT signing secret from the ESP hardware RNG and redact stored secrets from ordinary settings responses
• preserve customized legacy installs, force unchanged public defaults back to provisioning, and add authenticated reset/recovery behavior
• keep AP, Wi-Fi, OTA, and user password updates compatible with redacted responses
• document the security boundary and physical-device evidence that remains outstanding

Fixes #7

Verification

• python3 -m unittest discover -s tests -p 'test_provisioning.py' -v (9 passed)
• installer, logging, and release Python suites (48 passed)
• CI=true npm test -- --watchAll=false (108 passed)
• npm run build
• go test -race ./...
• go vet ./...
• go build ./...
• pio run -e esp12e
• pio run -e esp12e -t buildfs
• workflow YAML parse and git diff --check

Hardware boundary

Firmware and filesystem images compile successfully, but AP visibility, disconnect timing, power-loss interruption, and serial recovery still require physical ESP8266 validation. This change does not add or approve mains control, payment processing, or production deployment.