feat: Guest WiFi, network intelligence, firmware orchestration, platform automation, api-ssl (v0.16.3-beta)

Guest WiFi (Hotspot): one-click captive-portal wizard that creates the guest
SSID (virtual AP per radio), VLAN/bridge segregation + L3 VLAN interface, pool,
DHCP, portal, rate-limited guest profile, and masquerade; vouchers with limits +
printable sheets; live guest sessions; walled garden.

Network intelligence: per-client device fingerprinting (vendor/hostname →
category) with a persisted per-client override on the detail page; rogue/neighbor
AP detection from stored AP scans (evil-twin flagging); Mist-style anomaly
insights (client-count/CPU vs same-hour 14-day baseline + error bursts) in the
Operations engine.

Firmware orchestration: staged wave-based RouterOS rollouts (canary first) with
pre-upgrade backup, reboot-ride-out, version verification, halt-on-failure, and
scheduling; live per-device progress + cancel.

Platform & automation: scoped API tokens (mtm_, read/write, hashed at rest,
Bearer auth in requireAuth); outbound webhooks (12 events, HMAC-signed) fired
from the alert pipeline + firmware orchestrator; scheduled email reports.

api-ssl: RouterOSClient negotiates TLS on port 8729 and accepts RouterOS's
default self-signed certs (rejectUnauthorized:false), so SSL-secured API devices
connect without manual cert trust. Fixes #57.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/types/index.ts

@@ -190,6 +190,12 @@ export interface Client {
   device_name?: string;
   mac_address: string;
   custom_name?: string;
+  /** Effective device category: user override if set, else the fingerprint. */
+  device_category?: string;
+  /** What the fingerprint engine detected (before any user override). */
+  auto_category?: string;
+  /** User's manual category override, if any. */
+  custom_category?: string | null;
   hostname?: string;
   vendor?: string;
   ip_address?: string;
@@ -364,6 +370,20 @@ export interface WirelessMetricPoint {
   noise_floor?: number;
 }
 
+// ─── Rogue AP detection ─────────────────────────────────────────────────────
+
+export interface RogueAp {
+  ssid: string; bssid: string; vendor: string; signal: number; band: string;
+  seenBy: string; scannedAt: string;
+}
+export interface NeighborAp extends RogueAp { security: string }
+export interface RogueApReport {
+  rogues: RogueAp[];
+  neighbors: NeighborAp[];
+  lastScanAt: string | null;
+  scannedDevices: number;
+}
+
 // ─── RF Health ──────────────────────────────────────────────────────────────
 
 export interface RfChannelRow {