NET-05: replace direct Wi-Fi toggle with bounded profile UI #544

Work item

Implements v3 NET-05 — Wi-Fi UI on current main after merged NET-04A-D (#487–#490) and shared UI-05 (#502).

Current-main audit

Bloom Shell still models Wi-Fi as an inline toggle. A and left/right synchronously call bloom-network request enable|disable. That bypasses the guarded NET-04 profile/scan surface, conflicts with the transaction layer's explicit refusal to perform a sole-route remote Wi-Fi disable, and can leave the UI displaying desired state while association recovery is still unresolved.

Intended slice

• replace the settings-row direct toggle with an explicit Wi-Fi detail surface built from shared Bloom UI components
• keep Original Mini V1-V4 hidden and expose the surface only for qualified Plus/Flip capabilities
• show desired, acquiring, associated, unavailable, operation, and recoverable-error states distinctly
• consume only bounded, redacted NET-03/NET-04 profile and scan authorities
• bound scan history/results, focus, retry, cancellation, profile selection, and stale-operation handling
• keep passwords out of logs, status JSON, screenshots, durable Shell state, and command arguments; secret entry may reach only the fixed stdin profile boundary
• remove direct A/left/right Wi-Fi disable from Settings and Quick Settings until a physically recoverable local disable contract is qualified
• permit safe enable/reconcile and explicit profile-management operations without arbitrary command, path, SSID, or destination input
• fail closed when the installed backend or schema is older than the UI

Safety and validation

Host fixtures will first cover malformed output, bounds, timeouts, stale operations, secret clearing, fixed argv/stdin, and nonblocking UI state. A Mini Plus gate may use a Hot/Warm Shell-only candidate for read-only status and synthetic /tmp fixtures. No real scan, association/profile transition, Wi-Fi disable, reboot, signed update activation, listener change, key mutation, or live credential entry is authorized until the host contract is green and an independently recoverable device step is explicitly reached.

Parent program: #434. Dependencies: NET-04 / #486 and UI-05 / #502.