NET-04: add bounded Wi-Fi scan/connect/forget API #486

Work item

Implements v3 NET-04 — Bounded scan/connect/forget API on top of merged NET-03 (#485).

Intended slice

• one Bloom-owned asynchronous station-operation authority with bounded runtime and single active request
• cancelable scan/connect operations and bounded rate limits
• privacy-safe scan/status results with no credentials and no unrestricted logs
• connect by non-secret NET-03 profile ID; credentials remain inside the private store and projection boundary
• forget removes one explicit profile through the same private authority without exposing secrets
• fail-closed capability/path/dependency handling and atomic state
• no implicit open-network connection, WEP, arbitrary command/destination input, or remote Wi-Fi-disable path

Safety and validation

Host fixtures will cover timeout, cancellation, rate limiting, stale/live locks, malformed backend output, path/link attacks, secret redaction, and rollback/error behavior. Mini Plus validation will remain isolated and synthetic until a reviewed rollback-safe device gate exists; no live radio toggle, association mutation, reboot, update activation, listener change, or live profile change is authorized by this issue.

Parent program: #434. Dependency: NET-03 / #485 (fca10bb0168d8bc38737881745b68cd3bab9da59).