feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS)
- reference/namespace-vrf/: Linux namespace/VRF network isolation docs
- apps/android-agent: VPN permission check, StartResult sealed class

apps/device-agent-embedded/main/heartbeat.h

@@ -0,0 +1,35 @@
+/**
+ * @file heartbeat.h
+ * @brief HTTP Heartbeat Loop
+ */
+
+#ifndef HEARTBEAT_H
+#define HEARTBEAT_H
+
+#include <esp_err.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include "config.h"
+
+/**
+ * @brief Send heartbeat to server
+ * 
+ * @param config Device configuration
+ * @param status Device status ("connected", "recovering", "stopped")
+ * @param tunnel_up WireGuard tunnel status
+ * @param last_handshake Last handshake timestamp (epoch seconds)
+ * @return esp_err_t ESP_OK on success
+ */
+esp_err_t heartbeat_send(const wg_config_t *config, const char *status,
+                        bool tunnel_up, int64_t last_handshake);
+
+/**
+ * @brief Check if config changed based on hash comparison
+ * 
+ * @param old_hash Previous config hash
+ * @param new_hash New config hash
+ * @return true if config changed, false otherwise
+ */
+bool heartbeat_config_changed(const char *old_hash, const char *new_hash);
+
+#endif /* HEARTBEAT_H */