ATM environment alarm system

Simplification agreed during MQTT architecture discussion with Claude: the current app-based Wi-Fi provisioning flow (wifi_prov_mgr, SoftAP + ESPSoftAPProv app + QR code) can be dropped entirely.

Proposed replacement:

• STA network is hardcoded via Kconfig instead of runtime-provisioned: a dev/prod switch selects between Carsten's private Wi-Fi (development) and DTUdevice (production, reusing existing PS_DTU_WIFI_SSID/PS_DTU_WIFI_PASS). No app pairing, no QR code, no NVS-stored mutable STA credentials.
• DTUdevice becomes the PS's persistent default connection (not the brief boot+midnight hop it is today) - this also simplifies dtu_sync_task() back to ordinary periodic SNTP resync, and is a prerequisite for the continuous/frequent MQTT publishing discussed in #61 and #62.
• The reset button (currently: short press = silence sounder; hold at power-on = clear Wi-Fi credentials) gets a new long-press-during-normal-running gesture (~5s hold, visual indication once the threshold is crossed) that brings up the PS's own AP (ParSenXXXXXX) concurrently with the existing DTUdevice STA connection (ESP32 supports AP+STA simultaneously). The existing web server (already listening on all interfaces via HTTPD_DEFAULT_CONFIG()) becomes reachable at 192.168.4.1 on that AP with no new server instance - this is how OTA, config, and commissioning are accessed going forward, requiring physical presence, since DTUdevice itself blocks inbound.
• The "hold at power-on to clear Wi-Fi credentials" gesture becomes meaningless once the network is hardcoded and can be removed.

Manual's "Provisioning procedure" section (app, QR code) will need a full rewrite to describe the new reset-button-hold local-AP flow instead.

Confirmed technically feasible by inspecting the actual code: gpio_in.c already delivers clean debounced PRESSED/RELEASED events (hold-duration detection is a straightforward one-shot-timer addition on top), and web_server.cpp's web_server_start() uses HTTPD_DEFAULT_CONFIG() which binds to all interfaces already, so no separate server instance is needed for the AP path.

Not yet implemented - this issue tracks the agreed design pending a future session.