Implement 4-phase capture architecture: observe, target, capture

- Phase 2 (Observation): passive client mapping from data frame headers,
  ClientInfo array per slot (up to 8 clients), 5s observation window
- Phase 3 (Targeting): unicast deauth burst to each discovered client
  instead of broadcast, reason code 7, 5 frames per client
- Phase 4 (Capture): timeout + retry loop cycles back to observation
  to refresh stale client list (2 cycles within 30s channel timeout)
- Fix EAPOL detection: compute LLC/SNAP offset from QoS vs non-QoS
  header length, verify AA-AA-03 SNAP prefix, skip protected frames
- Concurrency: portMUX spinlock for callback/main-loop shared state,
  no dynamic alloc in callback, pre-allocated 4KB PCAP buffer per slot
- Phase-aware LCD status display (mapping → capturing → EAPOL count)

Made-with: Cursor

handshake-capture-c6/WiFi_Scanner.cpp

@@ -16,7 +16,7 @@ void WiFiScanner_Refresh(void) {
   scanNetworksSortedByRSSI();
 
   int count = 0;
-  for (int i = 0; i < 20; i++) {
+  for (int i = 0; i < MAX_NETWORKS; i++) {
     if (networks[i].ssid.isEmpty()) break;
     count++;
   }