feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS)
- reference/namespace-vrf/: Linux namespace/VRF network isolation docs
- apps/android-agent: VPN permission check, StartResult sealed class

apps/device-agent-embedded/main/wifi.h

@@ -0,0 +1,31 @@
+/**
+ * @file wifi.h
+ * @brief WiFi STA Management
+ */
+
+#ifndef WIFI_H
+#define WIFI_H
+
+#include <esp_err.h>
+
+/**
+ * @brief Initialize WiFi in STA mode
+ */
+esp_err_t wifi_init_sta(const char *ssid, const char *password);
+
+/**
+ * @brief Connect to WiFi
+ */
+esp_err_t wifi_connect(void);
+
+/**
+ * @brief Disconnect from WiFi
+ */
+esp_err_t wifi_disconnect(void);
+
+/**
+ * @brief Check if WiFi is connected
+ */
+bool wifi_is_connected(void);
+
+#endif /* WIFI_H */