wifi: add WPA2 AP setup API and pairing roadmap

docs/API.md

@@ -850,3 +850,44 @@ POST /api/v1/system/restart
 ```
 
 If added later, update this document and add contract tests.
+
+
+### AP configuration
+
+The Cargo ESP32 access point uses WPA2 authentication.
+
+On first boot, if no AP password exists, the controller generates and saves a unique password. Until the OLED setup display is added, that generated password is printed to Serial during boot.
+
+#### GET /api/v1/config/ap
+
+Returns AP metadata. The password is never returned.
+
+Example response:
+
+    {
+      "ok": true,
+      "ssid": "OverlandController",
+      "password_set": true,
+      "password_min_length": 8,
+      "password_max_length": 63,
+      "auth": "wpa2"
+    }
+
+#### POST /api/v1/config/ap
+
+Updates the AP SSID/password and restarts the access point.
+
+Example request:
+
+    {
+      "ssid": "Xterra-Camp",
+      "password": "new-secure-password"
+    }
+
+Rules:
+
+- SSID must be 1-32 characters.
+- Password must be 8-63 characters.
+- Password is stored in controller preferences.
+- Password is not returned by status or config APIs.
+- Future dashboard pairing will use Cargo-led credential migration so the dashboard follows AP credential changes automatically.