refactor(build): consolidate envs to production/debug/test; add compiler hardening flags

- Replace 11 per-frequency build environments with 3 role-based targets
  (production, debug, test) using shared [env] base section
- Move LoRa frequency and sender-ID config from build flags into config.h
  so all variants build from the same source
- Add -fstack-protector-strong, -D_FORTIFY_SOURCE=2, -Wformat-security
- Add Unity test framework to lib_deps for pio test support
- Add __pycache__/ to .gitignore

include/config.h

@@ -12,6 +12,25 @@ enum class BatchRetryPolicy : uint8_t {
   Drop = 1
 };
 
+// =============================================================================
+// ██  DEPLOYMENT SETTINGS  — adjust these for your hardware / frequency band
+// =============================================================================
+
+// LoRa frequency — uncomment ONE line:
+#define LORA_FREQUENCY_HZ 433E6    // 433 MHz (EU ISM, default)
+// #define LORA_FREQUENCY_HZ 868E6 // 868 MHz (EU SRD)
+// #define LORA_FREQUENCY_HZ 915E6 // 915 MHz (US ISM)
+
+// Expected sender device IDs (short-IDs).  The receiver will only accept
+// batches from these senders.  Add one entry per physical sender board.
+constexpr uint8_t NUM_SENDERS = 1;
+inline constexpr uint16_t EXPECTED_SENDER_IDS[NUM_SENDERS] = {
+  0xF19C   // TTGO #1 – 433 MHz sender
+  // 0x7EB4 // TTGO #2 – 868 MHz sender (uncomment & adjust NUM_SENDERS)
+};
+
+// =============================================================================
+
 // Pin definitions
 constexpr uint8_t PIN_LORA_SCK = 5;
 constexpr uint8_t PIN_LORA_MISO = 19;
@@ -34,10 +53,7 @@ constexpr uint8_t PIN_OLED_CTRL = 13;
 
 constexpr uint8_t PIN_METER_RX = 34;
 
-// LoRa settings
-#ifndef LORA_FREQUENCY_HZ
-#define LORA_FREQUENCY_HZ 433E6
-#endif
+// LoRa radio parameters
 constexpr long LORA_FREQUENCY = LORA_FREQUENCY_HZ;
 constexpr uint8_t LORA_SPREADING_FACTOR = 12;
 constexpr long LORA_BANDWIDTH = 125E3;
@@ -110,6 +126,8 @@ constexpr const char *AP_SSID_PREFIX = "DD3-Bridge-";
 constexpr const char *AP_PASSWORD = "changeme123";
 constexpr bool WEB_AUTH_REQUIRE_STA = true;
 constexpr bool WEB_AUTH_REQUIRE_AP = true;
+// SECURITY: these defaults are only used until the user sets credentials via
+// the web config page (/wifi).  The first-boot AP forces password change.
 constexpr const char *WEB_AUTH_DEFAULT_USER = "admin";
 constexpr const char *WEB_AUTH_DEFAULT_PASS = "admin";
 inline constexpr char HA_MANUFACTURER[] = "AcidBurns";
@@ -126,11 +144,6 @@ static_assert(
     HA_MANUFACTURER[9] == '\0',
     "HA_MANUFACTURER must remain exactly \"AcidBurns\"");
 
-constexpr uint8_t NUM_SENDERS = 1;
 constexpr uint32_t MIN_ACCEPTED_EPOCH_UTC = 1769904000UL; // 2026-02-01 00:00:00 UTC
-inline constexpr uint16_t EXPECTED_SENDER_IDS[NUM_SENDERS] = {
-  0xF19C //433mhz sender
-  //0x7EB4 //868mhz sender
-};
 
 DeviceRole detect_role();