Wi-Fi data path FIXED: esp_hosted 2.12 on both chips + C6 SDIO auto-OTA

Root cause of the dead data path (assoc/scan/RPC fine, zero data
frames): esp-hosted 1.4.x is formally incompatible with IDF 5.5
(esp-hosted-mcu#47) and the factory C6 slave firmware was ancient
(couldn't even answer a version RPC). Waveshare's examples pin 1.4.* —
do not follow them.

Fix:
- host: espressif/esp_hosted ^2.12 (+ esp_wifi_remote 1.6)
- slave: 2.12.11 network_adapter.bin embedded in the app (c6_ota.c
  streams it to the C6 over the SDIO RPC channel at boot when the
  reported version is < 2.x; ~10s, no wires, idempotent)
- RAM diet for hosted 2.x's footprint (MEMPOOL_PREFER_SPIRAM,
  reduced WIFI_RMT buffers) — without it internal SRAM famine
  boot-loops in xTaskCreateStaticPinnedToCore before app_main
- conservative 20MHz SDIO clock for first verified data path

Verified on hardware: DHCP lease (even that healed), 8/8 pings to
router and tower-of-joy at 1-5ms, WebSocket to the gateway connected,
device registered at /devices as desklock-p4 with fw version.

Also: wifi_diag.c L1 SoftAP diagnostic mode (DESKLOCK-DIAG) with
review fixes, boot ping ladder in net.c, static-IP fallback,
face_status() line, docs for the whole failure taxonomy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

firmware/sdkconfig.defaults

@@ -27,7 +27,31 @@ CONFIG_LV_FONT_MONTSERRAT_48=y
 CONFIG_LV_FONT_MONTSERRAT_28=y
 
 # ESP-Hosted C6 radio
-CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=y
 
 # custom fonts are uncompressed, but enable the decoder as belt-and-braces
 CONFIG_LV_USE_FONT_COMPRESSED=y
+
+# ESP-Hosted board variant + wifi-remote data-path tuning (from factory brookesia config;
+# without these the RPC control path works but data frames never flow)
+CONFIG_SLAVE_IDF_TARGET_ESP32C6=y
+CONFIG_ESP_HOSTED_CP_TARGET_ESP32C6=y
+CONFIG_ESP_HOSTED_P4_DEV_BOARD_FUNC_BOARD=y
+CONFIG_WIFI_RMT_STATIC_RX_BUFFER_NUM=8
+CONFIG_WIFI_RMT_DYNAMIC_RX_BUFFER_NUM=24
+CONFIG_WIFI_RMT_DYNAMIC_TX_BUFFER_NUM=24
+CONFIG_WIFI_RMT_AMPDU_TX_ENABLED=y
+CONFIG_WIFI_RMT_TX_BA_WIN=16
+CONFIG_WIFI_RMT_AMPDU_RX_ENABLED=y
+CONFIG_WIFI_RMT_RX_BA_WIN=16
+
+# hosted task stacks MUST stay in internal RAM (PSRAM stacks assert on P4)
+CONFIG_ESP_HOSTED_DFLT_TASK_FROM_SPIRAM=n
+
+# hosted 2.x: keep internal RAM for task stacks; buffers go to PSRAM
+CONFIG_ESP_HOSTED_MEMPOOL_PREFER_SPIRAM=y
+# conservative SDIO clock for first data-path proof (raise after verification)
+CONFIG_ESP_HOSTED_SDIO_CLOCK_FREQ_KHZ=20000
+
+# headroom for diag event handlers that touch LVGL
+CONFIG_ESP_SYSTEM_EVENT_TASK_STACK_SIZE=4096