Add Stratum V2 (SV2) protocol support with Noise encryption and fallback

Add full Stratum V2 mining protocol support to the bitaxe, enabling
encrypted communication with SV2 pools via Noise_NX handshake
(secp256k1+EllSwift, ChaChaPoly, SHA256). Includes a robust
protocol coordinator for clean failover between any combination
of V1/V2 primary and fallback pools without device restarts.

Protocol implementation:
- SV2 binary protocol (components/stratum_v2/): SetupConnection,
  OpenStandardMiningChannel, NewMiningJob, SetNewPrevHash, SetTarget,
  SubmitShares with proper frame encoding/decoding
- Noise encryption (sv2_noise.c): Full NX handshake with optional
  authority public key verification (TOFU mode when unconfigured)
- libsecp256k1 v0.6.0 as git submodule for elliptic curve operations

Protocol coordinator and fallback:
- Non-blocking event-driven coordinator manages protocol task lifecycle
- Supports all 4 failover combinations: V2->V1, V2->V2, V1->V2, V1->V1
- Timer-based heartbeat probes primary pool during fallback operation
- User-selected fallback (dashboard toggle) disables auto-recovery
- Clean state transitions: queue clear, share stats reset, proper
  task shutdown with event synchronization

Key reliability fixes:
- Heap-allocate sv2_conn to prevent dangling pointer after task exit
- Dynamic protocol check in create_jobs_task (was cached at startup,
  causing memory corruption on protocol switch)
- Single event per task exit (was double-signaling coordinator)
- Remove esp_restart() from V1 task, notify coordinator instead
- Fix V1 transport handle leak (destroy after close)
- Remove close_connection race from asic_result_task

Frontend and configuration:
- NVS settings for SV2 authority pubkey and fallback pool protocol
- Pool settings UI: protocol selector and SV2 pubkey for both pools,
  V1-only options hidden when SV2 selected
- Display: hide block height and scriptsig in SV2 mode (not available
  in standard channel), show protocol indicator instead
- OpenAPI spec updated with new SV2 configuration fields

Author: warioishere

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "components/libsecp256k1/libsecp256k1"]
+	path = components/libsecp256k1/libsecp256k1
+	url = https://github.com/bitcoin-core/secp256k1.git

components/libsecp256k1/CMakeLists.txt

@@ -0,0 +1,15 @@
+idf_component_register(
+    SRCS "libsecp256k1/src/secp256k1.c"
+         "libsecp256k1/src/precomputed_ecmult.c"
+         "libsecp256k1/src/precomputed_ecmult_gen.c"
+    INCLUDE_DIRS "libsecp256k1/include"
+    PRIV_INCLUDE_DIRS "libsecp256k1" "libsecp256k1/src"
+)
+target_compile_definitions(${COMPONENT_LIB} PRIVATE
+    ECMULT_WINDOW_SIZE=4
+    ECMULT_GEN_PREC_BITS=2
+    ENABLE_MODULE_ELLSWIFT=1
+    ENABLE_MODULE_SCHNORRSIG=1
+    ENABLE_MODULE_EXTRAKEYS=1
+)
+target_compile_options(${COMPONENT_LIB} PRIVATE -Wno-unused-parameter)

components/libsecp256k1/libsecp256k1

@@ -92,6 +92,9 @@ esp_transport_handle_t STRATUM_V1_transport_init(tls_mode tls, char * cert)
 
 void STRATUM_V1_initialize_buffer()
 {
+    // Free any existing buffer (may be non-NULL if a previous V1 task was running)
+    free(json_rpc_buffer);
+
     json_rpc_buffer = malloc(BUFFER_SIZE);
     json_rpc_buffer_size = BUFFER_SIZE;
     if (json_rpc_buffer == NULL) {

components/stratum/stratum_api.c

@@ -0,0 +1,5 @@
+idf_component_register(
+    SRCS "sv2_protocol.c" "sv2_noise.c"
+    INCLUDE_DIRS "include"
+    REQUIRES "mbedtls" "libsecp256k1" "tcp_transport"
+)

components/stratum_v2/CMakeLists.txt

@@ -0,0 +1,38 @@
+#ifndef SV2_NOISE_H
+#define SV2_NOISE_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "esp_transport.h"
+
+typedef struct sv2_noise_ctx sv2_noise_ctx_t;
+
+// Create a new Noise context (allocates secp256k1 context internally).
+sv2_noise_ctx_t *sv2_noise_create(void);
+
+// Destroy a Noise context and free all resources.
+void sv2_noise_destroy(sv2_noise_ctx_t *ctx);
+
+// Perform Noise_NX handshake as initiator over the given transport.
+// authority_pubkey is an optional 32-byte x-only public key for Schnorr
+// signature verification of the responder's certificate. Pass NULL to skip.
+// Returns 0 on success, -1 on error.
+int sv2_noise_handshake(sv2_noise_ctx_t *ctx, esp_transport_handle_t transport,
+                        const uint8_t *authority_pubkey);
+
+// Send an SV2 frame (header + payload) encrypted via Noise.
+// frame points to the complete plaintext frame (header + payload).
+// Returns 0 on success, -1 on error.
+int sv2_noise_send(sv2_noise_ctx_t *ctx, esp_transport_handle_t transport,
+                   const uint8_t *frame, int frame_len);
+
+// Receive and decrypt an SV2 frame via Noise.
+// hdr_out receives the 6-byte decrypted frame header.
+// payload_out receives the decrypted payload (up to max_payload_len bytes).
+// payload_len_out receives the actual payload length.
+// Returns 0 on success, -1 on error.
+int sv2_noise_recv(sv2_noise_ctx_t *ctx, esp_transport_handle_t transport,
+                   uint8_t hdr_out[6], uint8_t *payload_out,
+                   int max_payload_len, int *payload_len_out);
+
+#endif /* SV2_NOISE_H */

components/stratum_v2/include/sv2_noise.h

@@ -0,0 +1,137 @@
+#ifndef SV2_PROTOCOL_H
+#define SV2_PROTOCOL_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stddef.h>
+
+// Frame header size (extension_type[2] + msg_type[1] + msg_length[3])
+#define SV2_FRAME_HEADER_SIZE 6
+
+// Common message types
+#define SV2_MSG_SETUP_CONNECTION                        0x00
+#define SV2_MSG_SETUP_CONNECTION_SUCCESS                0x01
+#define SV2_MSG_SETUP_CONNECTION_ERROR                  0x02
+
+// Mining protocol message types (values from SV2 spec / SRI reference)
+#define SV2_MSG_OPEN_STANDARD_MINING_CHANNEL            0x10
+#define SV2_MSG_OPEN_STANDARD_MINING_CHANNEL_SUCCESS    0x11
+#define SV2_MSG_OPEN_MINING_CHANNEL_ERROR               0x12
+#define SV2_MSG_NEW_MINING_JOB                          0x15
+#define SV2_MSG_SUBMIT_SHARES_STANDARD                  0x1a
+#define SV2_MSG_SUBMIT_SHARES_SUCCESS                   0x1c
+#define SV2_MSG_SUBMIT_SHARES_ERROR                     0x1d
+#define SV2_MSG_SET_NEW_PREV_HASH                       0x20
+#define SV2_MSG_SET_TARGET                              0x21
+
+// Extension type flag for channel messages
+#define SV2_CHANNEL_MSG_FLAG 0x8000
+
+// Frame header (parsed)
+typedef struct {
+    uint16_t extension_type;
+    uint8_t msg_type;
+    uint32_t msg_length; // 24-bit value stored in 32-bit
+} sv2_frame_header_t;
+
+// Complete SV2 job (NewMiningJob + SetNewPrevHash combined)
+typedef struct {
+    uint32_t job_id;
+    uint32_t version;
+    uint8_t merkle_root[32]; // Internal byte order (as received from SV2)
+    uint8_t prev_hash[32];   // Internal byte order (as received from SV2)
+    uint32_t ntime;
+    uint32_t nbits;
+    bool clean_jobs;
+} sv2_job_t;
+
+// Pending future job (waiting for SetNewPrevHash)
+typedef struct {
+    uint32_t job_id;
+    uint32_t version;
+    uint8_t merkle_root[32];
+    bool valid;
+} sv2_pending_job_t;
+
+#define SV2_PENDING_JOBS_SIZE 8
+
+// SV2 connection state
+typedef struct sv2_conn {
+    uint32_t channel_id;
+    uint32_t sequence_number;
+    uint8_t target[32]; // U256 LE target
+    bool channel_opened;
+
+    // Pending future jobs ring buffer
+    sv2_pending_job_t pending_jobs[SV2_PENDING_JOBS_SIZE];
+
+    // Latest prev_hash state
+    uint8_t prev_hash[32];
+    uint32_t prev_hash_ntime;
+    uint32_t prev_hash_nbits;
+    bool has_prev_hash;
+} sv2_conn_t;
+
+// --- Frame encode/decode ---
+
+// Parse 6-byte frame header. Returns 0 on success.
+int sv2_parse_frame_header(const uint8_t *data, sv2_frame_header_t *header);
+
+// Encode 6-byte frame header into dest. Returns 6.
+int sv2_encode_frame_header(uint8_t *dest, uint16_t extension_type, uint8_t msg_type, uint32_t msg_length);
+
+// --- Message builders (return total frame size, or -1 on error) ---
+
+int sv2_build_setup_connection(uint8_t *buf, size_t buf_len,
+                               const char *host, uint16_t port,
+                               const char *vendor, const char *hw_version,
+                               const char *firmware, const char *device_id);
+
+int sv2_build_open_standard_mining_channel(uint8_t *buf, size_t buf_len,
+                                           uint32_t request_id,
+                                           const char *user_identity,
+                                           float nominal_hash_rate);
+
+int sv2_build_submit_shares_standard(uint8_t *buf, size_t buf_len,
+                                     uint32_t channel_id, uint32_t sequence_number,
+                                     uint32_t job_id, uint32_t nonce,
+                                     uint32_t ntime, uint32_t version);
+
+// --- Message parsers (return 0 on success, -1 on error) ---
+
+int sv2_parse_setup_connection_success(const uint8_t *payload, uint32_t len,
+                                       uint16_t *used_version, uint32_t *flags);
+
+int sv2_parse_open_channel_success(const uint8_t *payload, uint32_t len,
+                                   uint32_t *request_id, uint32_t *channel_id,
+                                   uint8_t target[32],
+                                   uint8_t *extranonce_prefix, uint8_t *extranonce_prefix_len,
+                                   uint32_t *group_channel_id);
+
+int sv2_parse_new_mining_job(const uint8_t *payload, uint32_t len,
+                             uint32_t *channel_id, uint32_t *job_id,
+                             bool *has_min_ntime, uint32_t *min_ntime,
+                             uint32_t *version,
+                             uint8_t merkle_root[32]);
+
+int sv2_parse_set_new_prev_hash(const uint8_t *payload, uint32_t len,
+                                uint32_t *channel_id, uint32_t *job_id,
+                                uint8_t prev_hash[32],
+                                uint32_t *min_ntime, uint32_t *nbits);
+
+int sv2_parse_set_target(const uint8_t *payload, uint32_t len,
+                         uint32_t *channel_id, uint8_t max_target[32]);
+
+int sv2_parse_submit_shares_success(const uint8_t *payload, uint32_t len,
+                                    uint32_t *channel_id);
+
+int sv2_parse_submit_shares_error(const uint8_t *payload, uint32_t len,
+                                  uint32_t *channel_id, uint32_t *seq_num,
+                                  char *error_code, size_t error_code_size);
+
+// --- Helpers ---
+
+// Convert U256 LE target to pool difficulty (pdiff)
+uint32_t sv2_target_to_pdiff(const uint8_t target[32]);
+
+#endif /* SV2_PROTOCOL_H */