fix(firmware): MGMT-only promiscuous filter to prevent SPI cache crash

The WiFi driver's wDev_ProcessFiq interrupt handler crashes with
LoadProhibited in cache_ll_l1_resume_icache when promiscuous mode
captures MGMT+DATA frames (100-500 interrupts/sec). The high interrupt
rate races with SPI flash cache operations, corrupting cache state.

Changes:
- Promiscuous filter: MGMT+DATA → MGMT-only (~10 Hz beacons)
- CSI config: disable htltf_en and stbc_htltf2_en (LLTF-only)

LLTF provides 64 subcarriers (HT20) — sufficient for presence,
breathing, and fall detection. The 10 Hz beacon rate eliminates
the SPI flash cache contention that caused the crash.

Verified on device 80:b5:4e:c1:be:b8:
- Before: LoadProhibited crash at ~1600-2400 callbacks (every ~70s)
- After: 2700+ callbacks over 4.7 minutes, zero crashes

Backtrace decode confirmed crash in ESP-IDF closed-source WiFi blob:
  _xt_lowint1 → wDev_ProcessFiq → spi_flash_restore_cache
  → cache_ll_l1_resume_icache → EXCVADDR=0x00000004 (NULL deref)

Co-Authored-By: Ruflo & AQE

firmware/esp32-csi-node/main/csi_collector.c

@@ -315,17 +315,26 @@ void csi_collector_init(void)
     ESP_ERROR_CHECK(esp_wifi_set_promiscuous(true));
     ESP_ERROR_CHECK(esp_wifi_set_promiscuous_rx_cb(wifi_promiscuous_cb));
 
+    /* Filter promiscuous to management frames only (beacons, probes).
+     * Data frames add 100-500+ interrupts/sec which causes Core 0
+     * LoadProhibited panics in wDev_ProcessFiq → cache_ll_l1_resume_icache
+     * due to SPI flash cache contention at high interrupt rates.
+     * Management-only gives ~10-20 frames/sec — enough for CSI sensing. */
     wifi_promiscuous_filter_t filt = {
-        .filter_mask = WIFI_PROMIS_FILTER_MASK_MGMT | WIFI_PROMIS_FILTER_MASK_DATA,
+        .filter_mask = WIFI_PROMIS_FILTER_MASK_MGMT,
     };
     ESP_ERROR_CHECK(esp_wifi_set_promiscuous_filter(&filt));
 
-    ESP_LOGI(TAG, "Promiscuous mode enabled for CSI capture");
+    ESP_LOGI(TAG, "Promiscuous mode enabled (MGMT-only filter to avoid SPI cache crash)");
 
+    /* Disable HT-LTF and STBC to reduce per-frame processing overhead.
+     * LLTF alone provides 64 subcarriers (HT20) — sufficient for presence,
+     * breathing, and fall detection. HT-LTF/STBC add subcarriers but also
+     * increase interrupt handler duration, worsening the cache race. */
     wifi_csi_config_t csi_config = {
         .lltf_en = true,
-        .htltf_en = true,
+        .htltf_en = false,
-        .stbc_htltf2_en = true,
+        .stbc_htltf2_en = false,
         .ltf_merge_en = true,
         .channel_filter_en = false,
         .manu_scale = false,