zephyr-cp/wifi: implement station connect, IPv4 getters and real authmode

[mikeysklar]

What

Implements Wi-Fi station connect for zephyr-cp, and fills in the IPv4 getters,
wifi.radio.addresses, real authmode reporting, and the raw MAC helper.

Why

common_hal_wifi_radio_connect() was a stub. Its body was commented-out ESP-IDF
code and it returned WIFI_RADIO_ERROR_NONE without attempting anything, so
connect() silently "succeeded" while never associating. get_connected()
returned a hardcoded false and the IPv4 getters returned None. No zephyr-cp
board could join a network.

The individual fixes:

• connect() via NET_REQUEST_WIFI_CONNECT, waiting on a semaphore signalled
  from CONNECT_RESULT (or DISCONNECT_RESULT, which is how a failed attempt
  reports), honouring the timeout and staying interruptible, then starting DHCPv4.
  wifi_conn_status is mapped to the CircuitPython error codes so a wrong
  password raises AUTH_FAIL instead of appearing to succeed.
• Per-AP security selection. The SiWx91x driver maps
  WIFI_SECURITY_TYPE_PSK to WPA2 and WPA_AUTO_PERSONAL to WPA3-transition,
  and neither works everywhere: a WPA2-PSK AP rejects WPA3-transition and a
  WPA3-SAE AP rejects WPA2, both surfacing identically as "Authentication
  failure". So the most recent scan is cached (24 entries) and the SSID looked up
  at connect time, falling back to WPA2-PSK when unseen. Known limit: that
  fallback is silently wrong for a WPA3-only hidden AP.
• get_authmode() built its mask from a switch that was entirely commented
  out and always returned an empty list, which reads as an open network.
• get_mac_address() returned an uninitialized stack buffer.
• The "ip" field in /cp/version.json was always 0: wifi_radio_get_ipv4_address()
  is a separate entry point from the Python-facing getter and was a separate stub.
• wifi.radio.addresses returned None, the wrong type in both states for
  the documented Sequence[str] contract.
• net_if_ip.ipv4 is guarded, since that member only exists with
  CONFIG_NET_IPV4 and this file builds for every Wi-Fi board in the port,
  including nrf7002dk which does not enable it.

Hardware tested

• SiWx917-DK2605A (Zephyr board siwx917_dk2605a, SoC SiWG917M111MGTBA), two
  boards: one on macOS 15, one on Ubuntu 24.04.
• Built and run on top of the board definition from zephyr-cp: add the Silicon Labs SiWx917-DK2605A #11218 (not yet merged).

Not tested: WPA3-SAE association, hidden networks, AP mode (not implemented on
this port), and any non-SiWx917 zephyr-cp board.

How I tested it

code.py:

import os, wifi, socketpool
n = sum(1 for _ in wifi.radio.start_scanning_networks())
wifi.radio.stop_scanning_networks()
print("scan COUNT:", n)
wifi.radio.connect(os.getenv("CIRCUITPY_WIFI_SSID"), os.getenv("CIRCUITPY_WIFI_PASSWORD"))
print("connected:", wifi.radio.connected, "ip:", wifi.radio.ipv4_address)
print("gw/sn/dns:", wifi.radio.ipv4_gateway, wifi.radio.ipv4_subnet, wifi.radio.ipv4_dns)
print("addresses:", wifi.radio.addresses)
pool = socketpool.SocketPool(wifi.radio)
addr = pool.getaddrinfo("example.com", 80)[0][-1]
s = pool.socket(pool.AF_INET, pool.SOCK_STREAM); s.settimeout(8)
s.connect(addr); s.send(b"HEAD / HTTP/1.0\r\nHost: example.com\r\n\r\n")
b = bytearray(48); k = s.recv_into(b); s.close()
print("http:", bytes(b[:k]).split(b"\r\n")[0])

Serial output:

scan COUNT: 36
connected: True ip: 192.168.0.39
gw/sn/dns: 192.168.0.1 255.255.255.0 192.168.0.1
addresses: ('192.168.0.39',)
http: b'HTTP/1.1 200 OK'

Scan now reports real per-network authmodes rather than an empty list, including
the WPA2/WPA3 distinction the security selection depends on:

('foreverrun',       -51, 5, [wifi.AuthMode.WPA2, wifi.AuthMode.PSK])
('Sids-Dungeon',     -52, 6, [wifi.AuthMode.WPA3, wifi.AuthMode.PSK])
('Roberto_Forever',  -66, 6, [wifi.AuthMode.WPA3, wifi.AuthMode.PSK])

The "ip" field fix, over the web workflow on the second board:

$ curl -s http://192.168.0.133/cp/version.json
{"web_api_version": 4, "version": "10.3.0-alpha.4-70-...", "board_id": "siwx917_dk2605a",
 ..., "ip": "192.168.0.133"}

board_name and hostname stay empty for an unrelated reason noted above: this
port has no common-hal/mdns.

Scope

AP mode stays unimplemented. radio.dns (the setter) is deliberately not
included; only the read-only ipv4_dns getter is here.

Notes

No new translatable strings and no locale/circuitpython.pot churn. The two
MP_ERROR_TEXT uses reuse "Only IPv4 addresses supported", which already exists
and is used by the espressif and raspberrypi ports.

Second of three PRs. Stacked on #11223 and on the logging PR, so this diff also
shows their changes until they merge.

AI assistance

Written with Claude Code. I reviewed the diff myself and verified the behaviour
on the hardware listed above.

[tannewt]

Thanks for working on this!

[tannewt]

Combine these. You don't need a separate function.

[tannewt]

Background task here?

[mikeysklar]

Security. Dropped the scan cache. Pico W is the closest case, since CYW43 needs an explicit auth mode the way Zephyr does, and it just uses password_len ? CYW43_AUTH_WPA2_AES_PSK : CYW43_AUTH_OPEN with no cache. Espressif sets nothing and lets the IDF infer it. So this does the same: password means WPA_AUTO_PERSONAL, no password means NONE. The driver maps WPA_AUTO_PERSONAL to WPA3-transition, so unlike Pico W's hardcoded WPA2 it also works on a WPA3-only AP. That removes the cached-channel question, there is no cache left. (WIFI_SECURITY_TYPE_UNKNOWN is not usable, the driver returns -ENOTSUP.)

Combined the mac helper into its only caller. Background tasks added to all three waits, matching espressif.

addresses_ap: the docstring already says "Empty sequence when disabled", which is what it returns. Making it Optional would be a shared-bindings change across all ports, so I left it.

connect() taking a ScanResult: new public API, better agreed in an issue than added here. I can file one if you want it.

Associates on two boards, 192.168.0.39 and 192.168.0.133.

[tannewt]

One more small thing.

[tannewt]

Revert this back

[tannewt]

Thank you!