fix: overhaul WiFi captive portal for reliable setup (#296)

* fix: overhaul WiFi captive portal for reliable device detection and fast setup

The captive portal detection endpoints were returning "success" responses
that told every OS (iOS, Android, Windows, Firefox) that internet was
working — so the portal popup never appeared. This fixes the core issue
and improves the full setup flow:

- Return portal-triggering redirects when AP mode is active; normal
  success responses when not (no false popups on connected devices)
- Add lightweight self-contained setup page (9KB, no frameworks) for
  the captive portal webview instead of the full UI
- Cache AP mode check with 5s TTL (single systemctl call vs full
  WiFiManager instantiation per request)
- Stop disabling AP mode during WiFi scans (which disconnected users);
  serve cached/pre-scanned results instead
- Pre-scan networks before enabling AP mode so captive portal has
  results immediately
- Use dnsmasq.d drop-in config instead of overwriting /etc/dnsmasq.conf
  (preserves Pi-hole and other services)
- Fix manual SSID input bug that incorrectly overwrote dropdown selection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review findings for WiFi captive portal

- Remove orphaned comment left over from old scan_networks() finally block
- Add sudoers rules for dnsmasq drop-in copy/remove to install script
- Combine cached-network message into single showMsg call (was overwriting)
- Return (networks, was_cached) tuple from scan_networks() so API endpoint
  derives cached flag from the scan itself instead of a redundant AP check
- Narrow exception catch in AP mode cache to SubprocessError/OSError and
  log the failure for remote debugging
- Bound checkNewIP retries to 20 attempts (60s) before showing fallback

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web_interface/blueprints/api_v3.py

@@ -6363,24 +6363,17 @@ def get_wifi_status():
 
 @api_v3.route('/wifi/scan', methods=['GET'])
 def scan_wifi_networks():
-    """Scan for available WiFi networks
+    """Scan for available WiFi networks.
 
-    If AP mode is active, it will be temporarily disabled during scanning
-    and automatically re-enabled afterward. Users connected to the AP will
-    be briefly disconnected during this process.
+    When AP mode is active, returns cached scan results to avoid
+    disconnecting the user from the setup network.
     """
     try:
         from src.wifi_manager import WiFiManager
 
         wifi_manager = WiFiManager()
+        networks, was_cached = wifi_manager.scan_networks()
 
-        # Check if AP mode is active before scanning (for user notification)
-        ap_was_active = wifi_manager._is_ap_mode_active()
-
-        # Perform the scan (this will handle AP mode disabling/enabling internally)
-        networks = wifi_manager.scan_networks()
-
-        # Convert to dict format
         networks_data = [
             {
                 'ssid': net.ssid,
@@ -6393,16 +6386,14 @@ def scan_wifi_networks():
 
         response_data = {
             'status': 'success',
-            'data': networks_data
+            'data': networks_data,
+            'cached': was_cached,
         }
 
-        # Inform user if AP mode was temporarily disabled
-        if ap_was_active:
-            response_data['message'] = (
-                f'Found {len(networks_data)} networks. '
-                'Note: AP mode was temporarily disabled during scanning and has been re-enabled. '
-                'If you were connected to the setup network, you may need to reconnect.'
-            )
+        if was_cached and networks_data:
+            response_data['message'] = f'Found {len(networks_data)} cached networks.'
+        elif was_cached and not networks_data:
+            response_data['message'] = 'No cached networks available. Enter your network name manually.'
 
         return jsonify(response_data)
     except Exception as e: