Implement 4-phase capture architecture: observe, target, capture

- Phase 2 (Observation): passive client mapping from data frame headers,
  ClientInfo array per slot (up to 8 clients), 5s observation window
- Phase 3 (Targeting): unicast deauth burst to each discovered client
  instead of broadcast, reason code 7, 5 frames per client
- Phase 4 (Capture): timeout + retry loop cycles back to observation
  to refresh stale client list (2 cycles within 30s channel timeout)
- Fix EAPOL detection: compute LLC/SNAP offset from QoS vs non-QoS
  header length, verify AA-AA-03 SNAP prefix, skip protected frames
- Concurrency: portMUX spinlock for callback/main-loop shared state,
  no dynamic alloc in callback, pre-allocated 4KB PCAP buffer per slot
- Phase-aware LCD status display (mapping → capturing → EAPOL count)

Made-with: Cursor

handshake-capture-c6/HandshakeCapture.h

@@ -5,6 +5,11 @@
 #include "esp_wifi.h"
 #include <SD.h>
 
+#define MAX_SLOTS 3
+#define MAX_NETWORKS 20
+#define MAX_CLIENTS_PER_SLOT 8
+#define PCAP_MAX_SIZE 4096
+
 typedef struct {
   uint32_t magic_number;
   uint16_t version_major;
@@ -31,19 +36,46 @@ typedef struct {
   bool handshake_captured;
 } WifiNetwork;
 
-extern WifiNetwork networks[20];
-extern WifiNetwork target;
+typedef struct {
+  uint8_t mac[6];
+  uint32_t last_seen;
+} ClientInfo;
+
+typedef struct {
+  uint8_t bssid[6];
+  char ssid[33];
+  int network_index;
+  bool beacon_captured;
+  uint8_t eapol_count;
+  uint8_t pcap_buffer[PCAP_MAX_SIZE];
+  size_t pcap_size;
+  bool active;
+  ClientInfo clients[MAX_CLIENTS_PER_SLOT];
+  uint8_t client_count;
+} CaptureSlot;
+
+// Phase 3 (deauth burst) is transient — no dedicated state needed
+enum CapturePhase : uint8_t {
+  PHASE_OBSERVING,   // Phase 2: passive client mapping (RX only)
+  PHASE_CAPTURING    // Phase 4: EAPOL capture (RX only)
+};
+
+extern WifiNetwork networks[MAX_NETWORKS];
+extern CaptureSlot slots[MAX_SLOTS];
+extern volatile int pending_save_slots[MAX_SLOTS];
+extern volatile int latest_eapol_count;
 extern bool is_capturing;
-extern bool with_deauth;
+extern int current_channel;
+extern CapturePhase capturePhase;
 
 void handshakeCaptureInit();
+void handshakeCaptureProcessPending();
+void refillSlots();
 bool wasBssidCaptured(const uint8_t* bssid);
-void markBssidCaptured(const uint8_t* bssid);
 void scanNetworksSortedByRSSI();
-void startCapture(bool deauth);
+void startMultiCapture();
 void stopCapture();
-void setTarget(int index);
-int getCurrentTargetIndex();
-bool isHandshakeCaptured(int index);
 bool isCaptureable(int index);
 void handshakeCaptureLoop();
+int getCaptureableCount();
+int getBestChannel();