Add HMAC-SHA256 API authentication to board drivers and edit UI

- Both olimex_esp32_c6_evb and olimex_esp32_c6_evb_pn532 drivers now
  sign every API request with X-Request-Time / X-Request-Sig headers
  using HMAC-SHA256(api_secret, METHOD:path:unix_timestamp)
- Board model gains api_secret column (nullable, default None)
- boards.py edit route saves api_secret from form
- edit.html adds API Secret input with cryptographic Generate button
- If api_secret is empty/None, headers are omitted (backward compat)

app/models/board.py

@@ -43,6 +43,11 @@ class Board(db.Model):
     # Extra driver-specific config (JSON) – e.g. eWeLink credentials/token
     config_json = db.Column(db.Text, default="{}")
 
+    # HMAC-SHA256 shared secret for API request authentication.
+    # Must match API_SECRET defined in the board firmware's secrets.h.
+    # Leave None/empty to disable authentication (open access).
+    api_secret = db.Column(db.String(128), nullable=True, default=None)
+
     # ── relationships ────────────────────────────────────────────────
     workflows_trigger = db.relationship(
         "Workflow", foreign_keys="Workflow.trigger_board_id",