fix: settings ops review findings

- The frequency scan ops and reboot run on loop() like every op (ADR 0005).
  endFrequencyScan goes to the front of the loop queue, so it never waits
  behind an unpair that waits for the scan to end.
- A security save that leaves the device Secured, or changes its mode,
  closes every client, the saver too once its reply has gone. None to None
  closes nobody.
- proto must be a radio_proto value; frequency, rxBandwidth and deviation
  are checked against what the CC1101 can be set to.
- wifiNetworks sends fewer networks instead of none when they don't fit.
- A client WiFi scan doesn't start while the device joins a network.
- rebootTime is set before reboot; cancelSettingsSave is freeSettingsSave.
- PROTOCOL.md: pins that may be -1, and the fields the routes sent that
  moved elsewhere. e2e: the WiFi scan test goes by the connection in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/LoopQueue.h

@@ -67,8 +67,10 @@ class LoopQueue {
   public:
     void begin();
     // Hands the item to loop() without waiting, so it is safe from any task,
-    // including async_tcp.  False when the queue is full.
-    bool submit(const loop_item_t &item);
+    // including async_tcp.  False when the queue is full.  first puts it
+    // ahead of everything waiting: an item that ends a frequency scan, which
+    // an unpair at the head waits for (holdLoopItem).
+    bool submit(const loop_item_t &item, bool first = false);
     // Runs the waiting items in order.  Only from loop().
     void drain();
   private: