Add SV2 "require authentication" per-pool option

[cbyam]

Summary

Addresses the second gap in #1786. By default SV2 connects encrypted but
unauthenticated: with no authority pubkey set, the Noise_NX handshake takes
the "no authority pubkey" branch and mines anyway, so the user can't act on
the man-in-the-middle warning the UI shows on the Authority Pubkey field.

This adds a per-pool "Require Authentication" toggle. When it's on and no
authority pubkey is set, the SV2 task refuses to connect instead of falling
through to an unverifiable server. The verify path is unchanged.

Changes

• New per-pool NVS bool stratumV2RequireAuth / fallbackStratumV2RequireAuth,
  default false, so existing configs behave as before.
• stratum_v2_task refuses to connect when auth is required but no pubkey
  resolves (status shows SV2: Auth required - no key).
• REST config exposes the new booleans; openapi.yaml updated.
• Frontend checkbox next to the Authority Pubkey field, with a tooltip pointing
  back to the MITM warning.

Scope

Just the enforcement toggle, the small fix offered in #1786. The validity-window
check and boot-time SNTP clock from that issue are not here.

Testing

• AxeOS production build passes (ng build --configuration=production).
• Each changed C file passes a syntax and semantic compile under ESP-IDF v5.4,
  and sv2_noise.c compiles to an object in a full build. A complete link needs
  v5.5.3 (the CI toolchain) because of a pre-existing esp_transport_get_socket
  call elsewhere in the tree, so the final .bin is left to CI. Not flashed to
  hardware yet.

[0xf0xx0]

code ack, will test soon

anything against having this be the default path for remote conns instead of a toggle? im still learning how sv2 security works, i was under the impression the pubkey/encryption is required for remote servers and optional for the lan. kinda averse to adding another button to the settings as well

[cbyam]

you've basically got it right on the split, small correction: it's not encryption that's optional on LAN, that part's always on (Noise_NX establishes the session unconditionally). what's optional/mandatory is specifically the auth step - verifying the server cert against the authority pubkey. that's the "optional LAN, mandatory remote" language.

on defaulting instead of a toggle for remote - genuine limitation, not a preference: the firmware has no way to tell LAN from remote, it's operator config, not topology. so it can't switch on automatically by connection type, has to be a declared setting.

and the toggle isn't a duplicate of the pubkey field, even though it looks like it should be. empty key already skips verification and mines anyway - that's true today, no PR needed for that part. what #1786 flagged, and what this actually fixes, is the silent case: if someone thinks they're running verified but the key field is blank or got cleared, there's no signal - it just quietly falls back to unauthenticated. "no key" and "no key when I said I want this verified" need to be distinguishable, and the pubkey field alone can't do that.

so yeah, one more control, but it's closing a real footgun, not adding a redundant one.

[0xf0xx0]

one nit, otherwise acked

[0xf0xx0]

mayb add a forced linebreak here, "authentication" overlaps the button slightly on my screen

[cbyam]

fixed in 20de1ef. the overlap came from tooltip-text-icon keeping the last word + icon in a nowrap span, so "Authentication" could not wrap in the narrow desktop label column. now it breaks after "Require" on desktop widths only - mobile keeps the single line since the label is full-width there.

[0xf0xx0]

i forgot to reack

[0xf0xx0]

pls rebase uwu ill merge this soon