feat: settings ops, the WiFi and frequency scans, and reboot for socket protocol 2

Step 1d of the protocol 2 core (docs/SECURITY_PLAN.md).

- getSettings/saveSettings by section: general, network, mqtt, security,
  radio. A save is the settings route's request, so loop() applies it with
  the settings' own fromJSON(). ProtoSettings checks every field first:
  kind, range, string length, IP addresses.
- Secrets are only reported as has*. A security save replies with the
  client's new token and closes the other sockets; other saves send
  settingsChanged to the other clients.
- scanWifi runs an async scan from ESPNetwork, kept apart from the roaming
  scan, and wifiNetworks goes to the clients that asked.
- beginFrequencyScan, endFrequencyScan and reboot run at once on async_tcp,
  as their routes do: a scan's end mustn't wait in the loop queue behind an
  unpair that waits for the scan to end (new op kind 'a').
- e2e: test_settings.py and a --reboot flag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/LoopQueue.h

@@ -26,20 +26,24 @@ enum class loop_item_type_t : uint8_t {
   load_shades,     // replace the shades with /shades.tmp
   snapshot_fill,   // fill a read's ModelSnapshot
   model_edit,      // apply an edit with ModelEditor
-  proto_read       // answer a protocol 2 read op from the shade model
+  proto_read,      // answer a protocol 2 read op from the shade model
+  proto_device     // run a protocol 2 settings op or the WiFi scan (DeviceOps)
 };
 struct model_edit_t;
+struct settings_save_t;
 struct loop_item_t {
   loop_item_type_t type = loop_item_type_t::shade_request;
   shade_request_t request;        // shade_request
   uint8_t restoreParts = 0;       // restore_shades: RESTORE_* bits
   uint8_t slot = 0;               // snapshot_fill: the SnapshotSlots slot
   model_edit_t *edit = nullptr;   // model_edit: loop() runs and frees it
-  // shade_request and proto_read from a protocol 2 client: loop() replies
-  // once it has run.
+  // shade_request, proto_read and proto_device from a protocol 2 client:
+  // loop() replies once it has run.
   proto_reply_to_t replyTo;
-  uint8_t readOp = 0;             // proto_read: the op's type
+  uint8_t op = 0;                 // proto_read and proto_device: the op's type
   uint8_t groupId = 0;            // proto_read: groupOptions' group
+  uint8_t section = 0;            // proto_device: getSettings' settings_section_t
+  settings_save_t *save = nullptr; // proto_device: saveSettings' save, which loop() frees
 };
 
 // Whether the item sends anything on air.