feat: reporter — HMAC-signed hourly POST with 24-record offline buffer

Fix Arduino String .size() → .length() in hmac.cpp (pre-existing bug surfaced by compilation).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

firmware/src/reporter.cpp

@@ -0,0 +1,130 @@
+// firmware/src/reporter.cpp
+#include "reporter.h"
+#include "hmac.h"
+#include <HTTPClient.h>
+#include <ArduinoJson.h>
+#include <WiFi.h>
+#include <vector>
+#include <time.h>
+
+static std::vector<CameraHourlyRecord> s_cam_buf;
+static std::vector<BLEHourlyRecord>    s_ble_buf;
+
+// Returns current Unix timestamp (NTP-synced via configTime in main.cpp).
+static uint32_t now_ts() {
+    return (uint32_t)time(nullptr);
+}
+
+static bool post_json(const DeviceConfig& cfg, const char* path, const String& body) {
+    uint32_t ts  = now_ts();
+    String   sig = hmac_sign(cfg.hmac_secret, cfg.device_id, ts, body);
+    if (sig.isEmpty()) return false; // HMAC failed
+
+    HTTPClient http;
+    String url = String(REPORTER_API_HOST) + path;
+    http.begin(url);
+    http.addHeader("Content-Type", "application/json");
+    http.addHeader("X-Device-Id",       cfg.device_id);
+    http.addHeader("X-Timestamp",        String(ts));
+    http.addHeader("X-HMAC-Signature",   sig);
+
+    int code = http.POST(body);
+    http.end();
+    return (code == 200);
+}
+
+static String build_camera_batch(const DeviceConfig& cfg,
+                                  const std::vector<CameraHourlyRecord>& recs) {
+    JsonDocument doc;
+    doc["location_id"] = cfg.location_id;
+    JsonArray arr = doc["records"].to<JsonArray>();
+    for (const auto& r : recs) {
+        JsonObject o = arr.add<JsonObject>();
+        o["period_start"] = r.period_start;
+        o["period_end"]   = r.period_end;
+        o["entries"]      = r.entries;
+        o["exits"]        = r.exits;
+    }
+    String out; serializeJson(doc, out);
+    return out;
+}
+
+static String build_ble_batch(const DeviceConfig& cfg,
+                               const std::vector<BLEHourlyRecord>& recs) {
+    JsonDocument doc;
+    doc["location_id"] = cfg.location_id;
+    JsonArray arr = doc["records"].to<JsonArray>();
+    for (const auto& r : recs) {
+        JsonObject o = arr.add<JsonObject>();
+        o["period_start"]   = r.period_start;
+        o["period_end"]     = r.period_end;
+        o["unique_devices"] = r.unique_devices;
+        o["max_concurrent"] = r.max_concurrent;
+        o["near_count"]     = r.near_count;
+        o["mid_count"]      = r.mid_count;
+        o["far_count"]      = r.far_count;
+        if (!r.device_hashes.empty()) {
+            JsonArray ha = o["device_hashes"].to<JsonArray>();
+            for (const auto& h : r.device_hashes) ha.add(h);
+        }
+    }
+    String out; serializeJson(doc, out);
+    return out;
+}
+
+static void buf_add_cam(const CameraHourlyRecord& r) {
+    if ((int)s_cam_buf.size() < REPORTER_MAX_BUFFER) s_cam_buf.push_back(r);
+}
+static void buf_add_ble(const BLEHourlyRecord& r) {
+    if ((int)s_ble_buf.size() < REPORTER_MAX_BUFFER) s_ble_buf.push_back(r);
+}
+
+void reporter_submit_camera(const DeviceConfig& cfg, const CameraHourlyRecord& rec) {
+    if (WiFi.status() != WL_CONNECTED) { buf_add_cam(rec); return; }
+
+    std::vector<CameraHourlyRecord> batch;
+    batch.insert(batch.end(), s_cam_buf.begin(), s_cam_buf.end());
+    batch.push_back(rec);
+    s_cam_buf.clear();
+
+    String body = build_camera_batch(cfg, batch);
+    if (!post_json(cfg, "/api/v1/camera/events/batch", body)) {
+        for (const auto& r : batch) buf_add_cam(r);
+    }
+}
+
+void reporter_submit_ble(const DeviceConfig& cfg, const BLEHourlyRecord& rec) {
+    if (WiFi.status() != WL_CONNECTED) { buf_add_ble(rec); return; }
+
+    std::vector<BLEHourlyRecord> batch;
+    batch.insert(batch.end(), s_ble_buf.begin(), s_ble_buf.end());
+    batch.push_back(rec);
+    s_ble_buf.clear();
+
+    String body = build_ble_batch(cfg, batch);
+    if (!post_json(cfg, "/api/v1/events/batch", body)) {
+        for (const auto& r : batch) buf_add_ble(r);
+    }
+}
+
+void reporter_heartbeat(const DeviceConfig& cfg, uint32_t uptime_s, int wifi_rssi) {
+    JsonDocument doc;
+    doc["firmware_version"]  = "1.0.0";
+    doc["free_storage_pct"]  = 100;
+    doc["wifi_rssi"]         = wifi_rssi;
+    doc["pending_records"]   = (int)(s_cam_buf.size() + s_ble_buf.size());
+    doc["uptime_seconds"]    = uptime_s;
+    String body; serializeJson(doc, body);
+    post_json(cfg, "/api/v1/heartbeat", body);
+}
+
+void reporter_flush(const DeviceConfig& cfg) {
+    if (!s_cam_buf.empty()) {
+        String body = build_camera_batch(cfg, s_cam_buf);
+        if (post_json(cfg, "/api/v1/camera/events/batch", body)) s_cam_buf.clear();
+    }
+    if (!s_ble_buf.empty()) {
+        String body = build_ble_batch(cfg, s_ble_buf);
+        if (post_json(cfg, "/api/v1/events/batch", body)) s_ble_buf.clear();
+    }
+}