feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS)
- reference/namespace-vrf/: Linux namespace/VRF network isolation docs
- apps/android-agent: VPN permission check, StartResult sealed class

apps/device-agent-embedded/main/crypto.h

@@ -0,0 +1,41 @@
+/**
+ * @file crypto.h
+ * @brief AES-256-GCM Crypto Operations
+ */
+
+#ifndef CRYPTO_H
+#define CRYPTO_H
+
+#include <esp_err.h>
+#include <stdint.h>
+
+/**
+ * @brief Initialize crypto module
+ */
+esp_err_t crypto_init(void);
+
+/**
+ * @brief Derive key from HWID + salt
+ * 
+ * @param hwid Hardware ID
+ * @param salt Salt string
+ * @param key Output 32-byte key
+ * @return esp_err_t ESP_OK on success
+ */
+esp_err_t crypto_derive_key(const char *hwid, const char *salt, uint8_t key[32]);
+
+/**
+ * @brief Decrypt AES-256-GCM ciphertext
+ * 
+ * @param ciphertext Input ciphertext (nonce + encrypted)
+ * @param len Ciphertext length
+ * @param key 32-byte key
+ * @param plaintext Output plaintext (caller must free)
+ * @param plaintext_len Output plaintext length
+ * @return esp_err_t ESP_OK on success
+ */
+esp_err_t crypto_decrypt(const uint8_t *ciphertext, size_t len,
+                        const uint8_t key[32], uint8_t **plaintext,
+                        size_t *plaintext_len);
+
+#endif /* CRYPTO_H */