feat: add embedded agent submodule and update architecture

- Add device-agent-embedded submodule (ESP32 WireGuard agent)
- Update README.md with embedded agent architecture
- Update update.sh to exclude device-agent and device-agent-embedded
  (both built separately, not part of Docker deployment)
- Add docs/DESIGN.md, API_COMPAT.md, HARDWARE.md for embedded agent
- Add Kconfig for menuconfig options
- Add sdkconfig.defaults for ESP-IDF configuration

.gitmodules

@@ -7,3 +7,6 @@
 [submodule "apps/device-agent"]
 	path = apps/device-agent
 	url = https://git.datadunia.com/nexusguard/nexus-device-agent.git
+[submodule "apps/device-agent-embedded"]
+	path = apps/device-agent-embedded
+	url = https://git.datadunia.com/nexusguard/nexus-agent-embedded.git

README.md

@@ -3,10 +3,11 @@
 NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.
 
 ## 🏗️ System Architecture
-This suite contains three main components:
+This suite contains four main components:
 1. **[Server Core](http://git.datadunia.com/nexusguard/nexus-server-core)**: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
 2. **[Dashboard UI](http://git.datadunia.com/nexusguard/nexus-dashboard-ui)**: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules. Features a futuristic glassmorphism design system using Vue 3, Vite, TailwindCSS v4, and HeadlessUI.
-3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
+3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux/Windows/macOS client machines that establishes memory-injected WireGuard tunnels.
+4. **[Device Agent Embedded](http://git.datadunia.com/nexusguard/nexus-agent-embedded)**: ESP32-based WireGuard agent for IoT/edge devices. Runs on FreeRTOS + ESP-IDF with lwIP stack.
 
 ---
 

update.sh

@@ -45,7 +45,10 @@ git pull origin main || { GIT_PULL_FAILED=true; echo "[!] Git pull for main repo
 
 echo "[+] Syncing and updating submodules..."
 SUBMODULE_FAILED=false
-git submodule update --init --recursive --remote || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
+# Exclude device-agent and device-agent-embedded (built separately, not Docker)
+git submodule update --init --recursive --remote \
+    --exclude apps/device-agent \
+    --exclude apps/device-agent-embedded || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
 
 # 2b. Build VitePress docs (non-blocking)
 echo "[+] Building VitePress documentation..."