Wi-Fi data path FIXED: esp_hosted 2.12 on both chips + C6 SDIO auto-OTA

Root cause of the dead data path (assoc/scan/RPC fine, zero data
frames): esp-hosted 1.4.x is formally incompatible with IDF 5.5
(esp-hosted-mcu#47) and the factory C6 slave firmware was ancient
(couldn't even answer a version RPC). Waveshare's examples pin 1.4.* —
do not follow them.

Fix:
- host: espressif/esp_hosted ^2.12 (+ esp_wifi_remote 1.6)
- slave: 2.12.11 network_adapter.bin embedded in the app (c6_ota.c
  streams it to the C6 over the SDIO RPC channel at boot when the
  reported version is < 2.x; ~10s, no wires, idempotent)
- RAM diet for hosted 2.x's footprint (MEMPOOL_PREFER_SPIRAM,
  reduced WIFI_RMT buffers) — without it internal SRAM famine
  boot-loops in xTaskCreateStaticPinnedToCore before app_main
- conservative 20MHz SDIO clock for first verified data path

Verified on hardware: DHCP lease (even that healed), 8/8 pings to
router and tower-of-joy at 1-5ms, WebSocket to the gateway connected,
device registered at /devices as desklock-p4 with fw version.

Also: wifi_diag.c L1 SoftAP diagnostic mode (DESKLOCK-DIAG) with
review fixes, boot ping ladder in net.c, static-IP fallback,
face_status() line, docs for the whole failure taxonomy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

firmware/main/net.c

@@ -8,6 +8,7 @@
 #include "esp_netif_sntp.h"
 #include "esp_wifi.h"
 #include "nvs_flash.h"
+#include "ping/ping_sock.h"
 
 #include "desklock.h"
 #include "secrets.h"
@@ -17,6 +18,9 @@ static const char *TAG = "net";
 static esp_netif_t *s_netif;
 static volatile bool s_got_ip;
 
+static void start_ping_diag(void);
+static void ping_diag_task(void *arg);
+
 /* Router DHCP has been observed to go silent for this MAC (flap throttling).
  * After 15 s without a lease, claim the previously granted address statically. */
 static void static_ip_fallback(void *arg)
@@ -40,6 +44,7 @@ static void static_ip_fallback(void *arg)
         esp_sntp_config_t sntp = ESP_NETIF_SNTP_DEFAULT_CONFIG("pool.ntp.org");
         esp_netif_sntp_init(&sntp);
         gw_start();
+        start_ping_diag();
     }
     vTaskDelete(NULL);
 }
@@ -84,9 +89,72 @@ static void wifi_event(void *arg, esp_event_base_t base, int32_t id, void *data)
         esp_sntp_config_t sntp = ESP_NETIF_SNTP_DEFAULT_CONFIG("pool.ntp.org");
         esp_netif_sntp_init(&sntp);
         gw_start();
+        start_ping_diag();
     }
 }
 
+static void ping_ok(esp_ping_handle_t h, void *arg)
+{
+    (void)arg;
+    uint32_t seq = 0, ms = 0;
+    ip_addr_t target;
+    esp_ping_get_profile(h, ESP_PING_PROF_SEQNO, &seq, sizeof(seq));
+    esp_ping_get_profile(h, ESP_PING_PROF_TIMEGAP, &ms, sizeof(ms));
+    esp_ping_get_profile(h, ESP_PING_PROF_IPADDR, &target, sizeof(target));
+    ESP_LOGI(TAG, "PING %s seq=%u %ums OK", ipaddr_ntoa(&target), (unsigned)seq, (unsigned)ms);
+}
+
+static void ping_timeout(esp_ping_handle_t h, void *arg)
+{
+    (void)arg;
+    uint32_t seq = 0;
+    ip_addr_t target;
+    esp_ping_get_profile(h, ESP_PING_PROF_SEQNO, &seq, sizeof(seq));
+    esp_ping_get_profile(h, ESP_PING_PROF_IPADDR, &target, sizeof(target));
+    ESP_LOGW(TAG, "PING %s seq=%u TIMEOUT", ipaddr_ntoa(&target), (unsigned)seq);
+}
+
+static void ping_target(const char *ip_str)
+{
+    esp_ping_config_t pc = ESP_PING_DEFAULT_CONFIG();
+    pc.count = 4;
+    pc.interval_ms = 500;
+    ipaddr_aton(ip_str, &pc.target_addr);
+    esp_ping_callbacks_t cbs = {
+        .on_ping_success = ping_ok,
+        .on_ping_timeout = ping_timeout,
+    };
+    esp_ping_handle_t h;
+    if (esp_ping_new_session(&pc, &cbs, &h) == ESP_OK) {
+        esp_ping_start(h);
+    }
+}
+
+static void start_ping_diag(void)
+{
+    static bool started;
+    if (!started) {
+        started = true;
+        xTaskCreate(ping_diag_task, "pingdiag", 4096, NULL, 3, NULL);
+    }
+}
+
+/* boot diagnosis: can the device reach the router at all? then the server? */
+static void ping_diag_task(void *arg)
+{
+    (void)arg;
+    vTaskDelay(pdMS_TO_TICKS(3000));
+    ESP_LOGI(TAG, "== ping diagnosis: router ==");
+    ping_target("192.168.86.1");
+    vTaskDelay(pdMS_TO_TICKS(6000));
+    ESP_LOGI(TAG, "== ping diagnosis: tower-of-joy ==");
+    ping_target("192.168.86.149");
+    vTaskDelay(pdMS_TO_TICKS(6000));
+    ESP_LOGI(TAG, "== slave wifi statistics dump ==");
+    esp_wifi_statis_dump(0xFFFFFFFF);
+    vTaskDelete(NULL);
+}
+
 void net_start(void)
 {
     esp_err_t err = nvs_flash_init();