feat(firmware): add Wi-Fi + TLS spike (Spike 6)

Standalone `wifi_tls` binary: station assoc, SNTP, then a validated
HTTPS GET to api.github.com against the esp-idf cert bundle. Gates
Spike 7 (gitoxide push). Creds come from firmware/.env via build.rs.

firmware/.env.example

@@ -0,0 +1,17 @@
+# Build-time config for the network spikes (6/7). Copy to `.env` and fill in.
+# `.env` is gitignored; `just` loads it automatically (dotenv-load) so the
+# values reach build.rs, which emits them as compile-time env for the binary.
+#
+#   cp .env.example .env   # then edit
+#   just flash-wifi        # Spike 6 — Wi-Fi + TLS
+#
+# Only the editor build (`just flash`) needs none of these.
+
+# Home Wi-Fi (2.4 GHz — the ESP32-S3 has no 5 GHz radio).
+TW_WIFI_SSID=your-ssid
+TW_WIFI_PASS=your-password
+# Note: the spike assumes WPA2-Personal. Open network → leave TW_WIFI_PASS empty.
+# A WPA3-only AP needs AuthMethod::WPA3Personal in src/bin/wifi_tls.rs.
+
+# Spike 7 (gitoxide push) will add: TW_REMOTE_URL, TW_GH_USER, TW_PAT,
+# TW_AUTHOR_NAME, TW_AUTHOR_EMAIL.