feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS)
- reference/namespace-vrf/: Linux namespace/VRF network isolation docs
- apps/android-agent: VPN permission check, StartResult sealed class

apps/device-agent-embedded/main/provision.h

@@ -0,0 +1,24 @@
+/**
+ * @file provision.h
+ * @brief HTTP Provisioning
+ */
+
+#ifndef PROVISION_H
+#define PROVISION_H
+
+#include <esp_err.h>
+#include "config.h"
+
+/**
+ * @brief Provision device with server
+ * 
+ * @param server_url Server URL (e.g., "https://api-nexus.datadunia.com")
+ * @param token Registration token
+ * @param hwid Hardware ID
+ * @param config Configuration to populate
+ * @return esp_err_t ESP_OK on success
+ */
+esp_err_t provision_device(const char *server_url, const char *token,
+                          const char *hwid, wg_config_t *config);
+
+#endif /* PROVISION_H */