v3060

## What's new, in plain language

This release folds in a large batch of fixes and improvements contributed by **@aepod** (Mathew): 38 pull requests, reviewed together, tested together, and shipped as one. Most of it makes RuView **more honest about what it is actually doing** and **safer by default**.

### If you run the sensing server

- **It no longer shows "connected" when nothing is connected.** The status page waits for a real frame from a device. If frames stop, it says so, and `/api/v1/sensing/latest` reports `stale` after 10 seconds instead of showing the last reading forever.
- **Real numbers instead of placeholders.** Frame rate and the number of connected WebSocket viewers are now measured, not fixed values.
- **A node that is not there no longer counts as one person.**
- **Privacy mode now covers everything.** `--privacy-mode` removes heart rate, breathing rate and pose from the web API, WebSocket and saved recordings, not just MQTT. (Presence, motion and person count are still shown. States that are *derived* from vitals, such as "someone sleeping", still pass through.)
- **Safer startup.** If you open the server to your network without an API token, it now refuses to start instead of silently exposing it.
- **Recordings and models stay in `--data-dir`.** Previously some went to a hard-coded folder.
- **Environment switches are friendlier.** `RUVIEW_UDP_INSECURE_LAN=1`, `yes` or `on` all work, not only `true`.
- **Fewer wrongly dropped frames.** The server now locks onto the most common frame shape. This is a partial fix: if one node alternates between two frame sizes, a large share of its frames can still be dropped. Tracked in the follow-up issue.

### If you use Docker or a Mac

- The Docker image makes clear when it can and cannot receive ESP32 data, instead of failing silently.
- On macOS, a redacted Wi-Fi link is now handled without inventing a network name.
- **Breaking change:** `--source macos`, `--source linux` and `--source windows` are no longer accepted and now exit with an error. Use `auto`, `esp32`, `wifi`, `mediatek`, `qualcomm`, `realtek` or `simulated`.

### If you set up ESP32 nodes

- **Your Wi-Fi password is kept private.** It is no longer shown on the command line or in `--state` output, and saved settings are readable only by you. (On Windows these file protections do not apply.)
- **Settings follow the board, not the USB port.** Swapping boards on the same port no longer applies the wrong node ID.
- **`--dry-run` and a failed `--reset` no longer overwrite your saved settings.**
- **Safer firmware updates.** A new over-the-air image is only confirmed once the node has reached the network and sent CSI. If not, the node rolls back. Note this means *"it came up and talked"*, not *"it is working well"*.

### New hardware support: MediaTek routers

Early support for reading Wi-Fi channel data from MediaTek MT7981 routers (such as the WN586X3), with a setup guide. **This is experimental:** it has been tested against one real capture, and the activity score it produces is a labelled rough guess, not a measurement of people.

### Home Assistant and MQTT

- Home Assistant now only gets entities that actually receive data (15 per node).
- Device IDs are stable across restarts.
- **Heads-up:** installs that already ran the older version keep six old entities until you delete them in Home Assistant.

### Training and labelling (for developers)

- Training now uses your real recordings, per node. If it ever has to fall back to live data, the result is marked **degraded** instead of quietly looking successful.
- New radar-based auto-labelling tools. Labels from radar are tagged as **unverified**, not ground truth.
- A node self-survey that **checks** your configured node positions (it never changes them), and a new way to export what RuView "sees" in a room.
- A plain bug fix: the signal "decay" no longer changed depending on how often it ran.

### Small but useful

- `scripts/prove.sh` now says INCOMPLETE instead of PASS when it skipped part of the proof.
- The dashboard asks for your API token instead of retrying forever.
- A weak 41.5%-accuracy sample model was removed from the repository, so it can no longer load automatically on startup.

## What is not in this release

- **MR60 radar detection change (#2142)** is held until it is checked against a real MR60BHA2 radar.
- **MacWifi.app (#2106)** is still a draft.

## How much to trust the numbers

We label evidence in this project. For this release:

- The test suites pass on the combined code, and CI is green. That is **MEASURED**.
- Hardware results quoted in the individual pull requests (for example one node going from 17.6% to 88.5% of frames used) come from the contributor's own live runs and have **not** been independently reproduced. Treat them as **CLAIMED**.
- WiFi sensing is not camera-grade. Nothing here changes that.

## Credit

Thank you to **@aepod** for the 38 pull requests and the unusually careful issue write-ups behind them.

Full details, conflict notes and review findings: PR #2163. Remaining work and open questions: issue #2165.