feat: Guest WiFi, network intelligence, firmware orchestration, platform automation, api-ssl (v0.16.3-beta)

Guest WiFi (Hotspot): one-click captive-portal wizard that creates the guest
SSID (virtual AP per radio), VLAN/bridge segregation + L3 VLAN interface, pool,
DHCP, portal, rate-limited guest profile, and masquerade; vouchers with limits +
printable sheets; live guest sessions; walled garden.

Network intelligence: per-client device fingerprinting (vendor/hostname →
category) with a persisted per-client override on the detail page; rogue/neighbor
AP detection from stored AP scans (evil-twin flagging); Mist-style anomaly
insights (client-count/CPU vs same-hour 14-day baseline + error bursts) in the
Operations engine.

Firmware orchestration: staged wave-based RouterOS rollouts (canary first) with
pre-upgrade backup, reboot-ride-out, version verification, halt-on-failure, and
scheduling; live per-device progress + cancel.

Platform & automation: scoped API tokens (mtm_, read/write, hashed at rest,
Bearer auth in requireAuth); outbound webhooks (12 events, HMAC-signed) fired
from the alert pipeline + firmware orchestrator; scheduled email reports.

api-ssl: RouterOSClient negotiates TLS on port 8729 and accepts RouterOS's
default self-signed certs (rejectUnauthorized:false), so SSL-secured API devices
connect without manual cert trust. Fixes #57.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/utils/clientCategories.ts

@@ -0,0 +1,24 @@
+import {
+  Network, Server, Monitor, Smartphone, Tv, Speaker, Camera, Printer,
+  Gamepad2, Mic, Home, Cpu, HelpCircle, type LucideIcon,
+} from 'lucide-react';
+
+// Device categories (must match the backend's DEVICE_CATEGORIES)
+export const CATEGORY_META: Record<string, { icon: LucideIcon; label: string }> = {
+  network:           { icon: Network,    label: 'Network gear' },
+  server:            { icon: Server,     label: 'Server / NAS' },
+  computer:          { icon: Monitor,    label: 'Computer' },
+  phone:             { icon: Smartphone, label: 'Phone / tablet' },
+  tv:                { icon: Tv,         label: 'TV / streaming' },
+  media:             { icon: Speaker,    label: 'AV / speaker' },
+  camera:            { icon: Camera,     label: 'Camera' },
+  printer:           { icon: Printer,    label: 'Printer' },
+  'game-console':    { icon: Gamepad2,   label: 'Game console' },
+  'voice-assistant': { icon: Mic,        label: 'Voice assistant' },
+  'smart-home':      { icon: Home,       label: 'Smart home' },
+  iot:               { icon: Cpu,        label: 'IoT device' },
+  unknown:           { icon: HelpCircle, label: 'Unknown' },
+};
+
+/** Categories a user can pick when overriding (same order as the meta map). */
+export const SELECTABLE_CATEGORIES = Object.keys(CATEGORY_META);