feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS)
- reference/namespace-vrf/: Linux namespace/VRF network isolation docs
- apps/android-agent: VPN permission check, StartResult sealed class

apps/device-agent-embedded/CMakeLists.txt

@@ -0,0 +1,40 @@
+cmake_minimum_required(VERSION 3.16)
+
+# ESP-IDF component registration
+idf_component_register(
+    SRCS 
+        "main.c"
+        "provision.c"
+        "heartbeat.c"
+        "tunnel.c"
+        "crypto.c"
+        "config.c"
+        "wifi.c"
+    INCLUDE_DIRS "."
+    REQUIRES 
+        esp_wifi
+        esp_event
+        esp_netif
+        nvs_flash
+        esp_http_client
+        esp_tls
+        mbedtls
+        json
+        lwip
+)
+
+# WireGuard component (external)
+# Add wireguard-esp32 as component
+set(COMPONENTS_DIR ${CMAKE_CURRENT_LIST_DIR}/../components)
+if(EXISTS ${COMPONENTS_DIR}/wireguard-esp32)
+    set(EXTRA_COMPONENT_DIRS ${COMPONENTS_DIR}/wireguard-esp32)
+endif()
+
+# Build flags
+target_compile_options(${COMPONENT_LIB} PRIVATE -Wall -Wextra -Werror)
+
+# Version
+target_compile_definitions(${COMPONENT_LIB} PRIVATE 
+    AGENT_VERSION="1.0.0"
+    BUILD_DATE="${BUILD_DATE}"
+)