Improve Wi-Fi onboarding and BLE provisioning

[Funkelfetisch]

Summary

• add Espressif BLE Wi-Fi provisioning for supported ESP32 variants and advertise it only while Network is in AP fallback onboarding
• use Security0 explicitly because the current hardware has no private per-device proof-of-possession secret; configured devices stop advertising the unauthenticated service
• inject the BLE runtime from main.cpp so core stays platform-neutral and desktop tests can exercise lifecycle behavior
• apply Wi-Fi credentials explicitly, retry dropped STA connections before AP fallback, and expose connection diagnostics

Review follow-up

• start AP when the SSID is cleared and cover the transition with regression tests
• use atomic BLE manager lifecycle flags across callback and main-task access
• remove the public MAC-derived pseudo-secret instead of presenting it as authentication
• port the module to the current lifecycle and System/Services structure

Validation

• git diff --check
• spec check: 90/90 modules current
• platform-boundary check passed
• firmware catalog check: 8 variants, 0 issues
• focused BLE/Network C++ tests: 24/24 cases, 112/112 assertions
• desktop scenarios: 20/20 passed
• Python host tests: 55/55 passed
• BLE-enabled esp32s3-n8r8 build: 1,893,036-byte image, 40% app partition free
• desktop production target built with warnings as errors

Remaining hardware validation

• a real BLE scan and Wi-Fi provisioning transaction is still pending because this Windows host exposes no Bluetooth adapter and no ADB-connected Android device
• the PR remains draft until that end-to-end provisioning test passes

Known external gate

• the complete x86 Zig ctest executable is blocked by the existing unused place helper warning in test/unit/core/unit_moonlive_ir.cpp; the focused BLE/Network executable passes

[coderabbitai]

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 13.16% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: improved Wi‑Fi onboarding plus added BLE provisioning support.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@esp32/sdkconfig.defaults.ble-provisioning`:
- Around line 9-11: Update makeIdentity() in the ESP32 BLE provisioning
implementation so Security 1 uses a unique, non-public per-device secret rather
than the MAC suffix mac[3..5]. Preserve the existing BLE service-name identity
separately, and ensure the generated secret is delivered through the established
out-of-band provisioning mechanism.

In `@src/core/NetworkModule.h`:
- Around line 325-338: Update the empty-SSID branch in onUpdate() to ensure AP
mode is actually started, reusing the existing behavior from
maybeApplyPendingWifiCredentials(): transition via startAP() when state_ is not
already State::AP, then report the status. Preserve clearing
wifiCredentialApplyPending_ and avoid restarting AP when it is already active.

In `@src/platform/esp32/platform_esp32_ble_provisioning.cpp`:
- Around line 23-37: Make the BleProvisioningState fields started and
initialized atomic, then update all accesses in bleProvEventCb,
bleProvisioningInit, and bleProvisioningStop to use atomic-safe reads and
writes. Preserve the existing branching and lifecycle behavior while ensuring
concurrent provisioning callbacks and main-thread teardown cannot race.
- Around line 66-75: Update makeIdentity so g_bleProv.pop is derived from a
private per-device secret or another non-advertised provisioning source, rather
than mac[3..5] used in serviceName. Keep the BLE service name generation
unchanged, and ensure the PoP remains available through the intended secure
channel or device labeling without being recoverable from the advertised name.

In `@test/unit/core/unit_NetworkModule.cpp`:
- Around line 66-117: Extend the NetworkModule regression coverage with a test
that sets a non-empty SSID, connects, then clears the SSID through
scheduler.setControl and verifies the module enters AP state using its state/API
assertion rather than only checking status text. Keep the test clock setup and
ClockGuard cleanup pattern, and ensure the assertion matches the specification
in docs/moonmodules/.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: bb426d11-8e5c-4171-9181-387836ea56c6

📥 Commits

Reviewing files that changed from the base of the PR and between 0c289ab and 7fb6aeb.

⛔ Files ignored due to path filters (1)

• moondeck/build/build_esp32.py is excluded by !**/build/**

📒 Files selected for processing (15)

• docs/moonmodules/core/services.md
• esp32/main/CMakeLists.txt
• esp32/main/Kconfig.projbuild
• esp32/main/idf_component.yml
• esp32/sdkconfig.defaults.ble-provisioning
• src/core/BleProvisioningModule.h
• src/core/NetworkModule.h
• src/main.cpp
• src/platform/desktop/platform_config.h
• src/platform/desktop/platform_desktop.cpp
• src/platform/esp32/platform_config.h
• src/platform/esp32/platform_esp32.cpp
• src/platform/esp32/platform_esp32_ble_provisioning.cpp
• src/platform/platform.h
• test/unit/core/unit_NetworkModule.cpp