Finish captive portal: NVS config, POST handler, STA connect, AP identity

Splits provisioning (softAP + captive portal + NVS-backed config) into
wifi_provisioning.c and home-network connection into frame_client.c.
/save_config now parses the form body and persists it to NVS; on boot the
device goes straight to STA mode if a config exists, retrying a few times
before falling back to provisioning if the home network is unreachable.

The provisioning AP is now always named ESPRESSO with a random per-device
password (generated once, persisted in NVS) instead of a fixed Kconfig
value, drawn from a charset that avoids visually ambiguous characters since
it'll be read off the e-ink panel and possibly typed by hand.

firmware/main/CMakeLists.txt

@@ -1,3 +1,3 @@
-idf_component_register(SRCS main.c
-                       PRIV_REQUIRES esp_event nvs_flash esp_wifi esp_http_server dns_server
+idf_component_register(SRCS main.c wifi_provisioning.c frame_client.c
+                       PRIV_REQUIRES esp_event nvs_flash esp_wifi esp_netif esp_http_server dns_server
                        EMBED_FILES root.html)