feat: Guest WiFi, network intelligence, firmware orchestration, platform automation, api-ssl (v0.16.3-beta)

Guest WiFi (Hotspot): one-click captive-portal wizard that creates the guest
SSID (virtual AP per radio), VLAN/bridge segregation + L3 VLAN interface, pool,
DHCP, portal, rate-limited guest profile, and masquerade; vouchers with limits +
printable sheets; live guest sessions; walled garden.

Network intelligence: per-client device fingerprinting (vendor/hostname →
category) with a persisted per-client override on the detail page; rogue/neighbor
AP detection from stored AP scans (evil-twin flagging); Mist-style anomaly
insights (client-count/CPU vs same-hour 14-day baseline + error bursts) in the
Operations engine.

Firmware orchestration: staged wave-based RouterOS rollouts (canary first) with
pre-upgrade backup, reboot-ride-out, version verification, halt-on-failure, and
scheduling; live per-device progress + cancel.

Platform & automation: scoped API tokens (mtm_, read/write, hashed at rest,
Bearer auth in requireAuth); outbound webhooks (12 events, HMAC-signed) fired
from the alert pipeline + firmware orchestrator; scheduled email reports.

api-ssl: RouterOSClient negotiates TLS on port 8729 and accepts RouterOS's
default self-signed certs (rejectUnauthorized:false), so SSL-secured API devices
connect without manual cert trust. Fixes #57.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/index.ts

@@ -36,6 +36,11 @@ import devicesRoutes, { setPollerService as setDevicesPoller } from './routes/de
 import clientsRoutes, { setPollerService as setClientsPoller } from './routes/clients';
 import eventsRoutes from './routes/events';
 import backupsRoutes from './routes/backups';
+import guestWifiRoutes from './routes/guestWifi';
+import firmwareRoutes from './routes/firmware';
+import automationRoutes from './routes/automation';
+import { reportService } from './services/ReportService';
+import { firmwareOrchestrator } from './services/FirmwareOrchestrator';
 import operationsRoutes from './routes/operations';
 import metricsRoutes from './routes/metrics';
 import topologyRoutes, { setPollerService as setTopologyPoller } from './routes/topology';
@@ -208,6 +213,9 @@ app.use('/api/clients', clientsRoutes);
 app.use('/api/events', eventsRoutes);
 app.use('/api/backups', backupsRoutes);
 app.use('/api/operations', operationsRoutes);
+app.use('/api/guest-wifi', guestWifiRoutes);
+app.use('/api/firmware', firmwareRoutes);
+app.use('/api/automation', automationRoutes);
 app.use('/api/metrics', metricsRoutes);
 app.use('/api/topology', topologyRoutes);
 app.use('/api/settings', settingsRoutes);
@@ -270,6 +278,12 @@ async function start(): Promise<void> {
   // NetFlow/IPFIX collector (binds its UDP socket only when netflow_enabled)
   await netflowCollector.start();
 
+  // Firmware rollout scheduler (starts rollouts whose scheduled_at has arrived)
+  firmwareOrchestrator.startScheduler();
+
+  // Scheduled report mailer (hourly check)
+  reportService.startScheduler();
+
   // Start HTTP server
   httpServer.listen(PORT, '0.0.0.0', () => {
     console.log(`✓ Mikrotik Manager backend running on port ${PORT}`);