wifi: add WPA2 AP setup API and pairing roadmap

docs/ARCHITECTURE.md

@@ -170,3 +170,26 @@ Future optional architecture:
       -> Cargo ESP32 outbound connection
 
 Remote features must not break local operation.
+
+
+## Cargo-led AP Pairing and Credential Migration
+
+The Cargo ESP32 owns the local overland network. It is the AP owner, source of truth, and configuration authority.
+
+Target behavior:
+
+1. Cargo ESP32 starts a WPA2-protected AP.
+2. Cargo OLED shows setup credentials and critical recovery/status information.
+3. Phone connects to the Cargo AP and uses the WebUI for setup/admin.
+4. Dashboard ESP32-S3 joins the Cargo AP as a client.
+5. If the user changes the Cargo AP SSID/password, the Cargo ESP stages the new credentials and coordinates dashboard migration.
+6. Dashboard stores the new credentials before the Cargo AP restarts.
+7. Cargo AP applies the new credentials.
+8. Dashboard reconnects automatically.
+
+The dashboard should not own network authority. A temporary dashboard setup AP may exist only as a recovery/fallback mechanism, not the normal pairing path.
+
+Recovery target:
+
+- A setup/status button on the Cargo ESP enclosure can show AP credentials on the OLED.
+- A long hold can restore factory AP credentials or enter recovery mode.