fix(setup): accept standard 64-hex Wi-Fi PSKs

[tang-vu]

Summary

• allow 64-character hexadecimal WPA pre-shared keys through the setup API
• enforce the same PSK shape at the host-agent mutation boundary
• retain the existing 63-character ceiling for non-hex passwords

Why this matters

NetworkManager's shipped contract accepts either an ASCII WPA passphrase or a 64-character hexadecimal pre-shared key. ODS capped the password field at 63 characters in both dashboard-api and host-agent, so a Linux operator whose access point is configured with a raw standards-compliant PSK could never connect through first-run setup.

Root cause: ODS modeled only the passphrase form of 802-11-wireless-security.psk. The invariant is parity between browser validation and host-agent validation: 64 characters are accepted only when every character is hexadecimal, and the exact value reaches nmcli unchanged.

NetworkManager contract: https://www.networkmanager.dev/docs/api/latest/nm-settings-nmcli.html

Overlap check

Searched open and closed PR titles for wifi password, WiFi PSK, 64 hex PSK, and NetworkManager password. No matching PR exists. I inspected all open PRs touching routers/setup.py and ods-host-agent.py; setup PRs #2816/#2572/#2437/#2323 concern atomic or malformed persisted state, while current host-agent PRs concern OpenCode, GPU/runtime, rootless connectivity, and lifecycle state. None changes Wi-Fi credential validation.

Regression tests

Two public handoff points are covered:

• authenticated POST /api/setup/wifi-connect accepts a 64-hex PSK and forwards it unchanged
• AgentHandler._handle_network_wifi_connect accepts the same request and invokes nmcli device wifi connect ... password <psk>

Both tests failed before the implementation (dashboard returned 422; host-agent returned 400). Post-fix validation:

• pytest tests/test_network_config.py -q — 18 passed
• pytest tests/test_host_agent.py -q — 258 passed, 4 skipped
• Python compile checks — passed
• git diff --check — passed

Platform scope, tradeoffs, and rollback

The browser schema is shared, but Wi-Fi mutation remains Linux/NetworkManager-only; macOS and Windows continue to receive the existing unsupported-platform response from host-agent. Non-hex 64-character values remain rejected, avoiding accidental expansion beyond NetworkManager's raw-PSK form. Revert commit bab15063 to roll back; no state migration is required.

Generated with Codex

Batch compatibility

Validated as an independent ten-PR batch from upstream main 6ff9b4fc5190099705043acaab7e9b6ad9c8b8f1. The final PR heads merged without conflicts in this order: #2964 -> #2965 -> #2967 -> #2969 -> #2970 -> #2971 -> #2972 -> #2973 -> #2974 -> #2975. The resulting local synthetic merge head is 4ae60eadad9696a9accb735aad71af87d2be802d.

Combined validation on that exact tree:

• Dashboard API boundary suites: 323 passed, 4 skipped.
• Token Spy suite: 36 passed, 1 skipped.
• Privacy Shield suite: 55 passed.
• APE suite: 47 passed.
• Python compile checks and git diff --check: passed.

The scopes are behaviorally independent. The stated order is the tested rollback/merge sequence for shared-file changes; each PR remains individually useful and revertible.