feat: add authenticated ESP32 BLE fusion path - #1696

Summary

Adds an authenticated, default closed BLE and external Channel Sounding path to the ESP32 S3 RuView node and the live sensing server.

1. Adds a passive NimBLE scanner for RuView specific authenticated rotating service tokens.
2. Adds a UART ingress for a separate Channel Sounding capable radio.
3. Adds fixed BLE, Channel Sounding, and RVAE gateway protocols with independent keys and bounded queues.
4. Adds provisioning support and compile time plus NVS feature gates.
5. Adds host parsing, complete Channel Sounding procedure validation, deterministic fusion simulation, abstention logic, and nonclinical respiration candidate estimation.
6. Adds a live worker with multiple independently keyed gateways, durable replay state, short lived pseudonyms, and audited P4 or P5 export overrides.
7. Records the complete decision, packet layouts, threat model, deployment sequence, rollback, and hardware acceptance gate in ADR 341.

Corrected capability model

1. ESP32 S3 can scan BLE advertisements and collect WiFi CSI.
2. ESP32 S3 does not expose raw BLE CTE IQ and does not implement Bluetooth Channel Sounding.
3. The Channel Sounding source is a separately enrolled capable radio. ESP32 S3 is forwarding provenance only.
4. BLE RSSI is proximity evidence, not coordinates or identity.
5. Normal iPhone advertisements are not stable identity credentials.
6. CTE direction finding and Channel Sounding are distinct procedures.
7. Channel Sounding phase and RTT do not automatically establish submillimetre vital sensing.

Security and privacy gates

1. BLE and Channel Sounding are disabled by default at compile time and in NVS.
2. Gateway, BLE advertiser, host pseudonym, and Channel Sounding keys are separate.
3. RVAE accepts only exact 92 byte and 128 byte envelopes before allocation.
4. Missing replay state fails closed. Initialization is one shot and a stale initialization option is rejected.
5. Secrets, replay state, locks, and audit files use private descriptor checks and reject symbolic links or file aliases.
6. Replay is durable before publication. Audit is durable before publication.
7. Any audit write or sync failure stops the worker and disconnects the ingress queue.
8. P4 biological and P5 identity export are disabled by default.
9. An export override requires loopback binding, real API authentication, and a private audit log. It is explicitly not a subject consent receipt.
10. Exact P0 phase, RTT, frequency offset, channel, and procedure vectors never enter WebSocket output.
11. Synthetic outputs are labeled SYNTHETIC. Live aggregates are labeled CLAIMED until hardware validation.

Validation

radio_ingress focused tests: 12 passed
ruview fusion tests: 23 passed
hardware tests: 192 passed, 1 ignored
sensing server library baseline: 535 passed, 1 ignored
firmware host suites: adaptive 18, feature 15, mesh 27, BLE and Channel Sounding protocol pass
provisioning tests: 12 passed
sensing server binary check: pass
targeted Clippy with known unrelated warning allowances: pass
new radio modules and touched main blocks: rustfmt check pass

ESP IDF 5.4.2 builds:

feature image : 1,327,888 bytes, 37 percent partition free
default image : 1,139,536 bytes, 46 percent partition free
feature cost  :   188,352 bytes

Both the feature build and the default build completed. BLE scanning and Channel Sounding remain disabled in the default image.

Related work

1. RuField PR: feat: add authenticated BLE and Channel Sounding evidence rufield#5
2. rvCSI PR: feat: add BLE CSI fusion evidence simulation rvcsi#3

Current live scope

The production boundary now authenticates and admits BLE plus Channel Sounding evidence and can publish standalone bounded aggregates under the explicit local export gate. CSI track association and CSI plus Channel Sounding rate fusion are implemented in deterministic library simulation but are not yet wired into the live sensing server track manager. This PR does not represent that follow on as live or measured.

Hardware status

Physical validation remains pending. Required work includes real ESP32 S3 coexistence measurements, UART verification with a Channel Sounding capable companion, at least 100 two person crossings, and comparison against a reference respiration belt and ECG or PPG where heartbeat research is attempted. No clinical, diagnostic, sleep staging, or heartbeat accuracy claim is made.