WiFi: NVS credential store, non-blocking connect, one-shot SD import (#99 child 1)

[Strycher]

Epic: #99 · Parent: #99 — child 1 of 4. Plan: docs/plans/2026-09-09-wifi-configuration.md (lands with this child). Approved by the owner 2026-09-09.

• Store: ESP32 NVS via Preferences, namespace wifi, up to 5 entries in priority order, deduplicated by SSID, oldest replaced when full. Unencrypted, by decision (plan).
• Boot and reconnect become one non-blocking state machine driven from loop(): WiFi.begin() on the first saved network, status + timeout checks, next network, no delay() loops. Delivers the WiFi item of Feature: interrupt-driven touch input and a main loop that never blocks #292. NTP sync on first connect as today.
• One-shot SD import: /config/wifi.txt (the Settings: WiFi configuration with on-screen keyboard #99 format) is read at boot, entries imported into NVS. The file is never modified or removed by this child; it exposes the import result for the prompts in children 2 and 3.
• The six credential literals in src/web.cpp go. Closes security: WiFi credentials hardcoded in Field_Compass.ino — needs a provisioning mechanism #147.

Acceptance: no SSID or password literal in any tracked file; both envs build; on the bench a main build joins the home network after one SD import (owner types the file); reconnect after AP loss without a loop stall; /diags reachable on the UM board for the first time.