- net_guard_tick now detects status-vs-event divergence. If s_up is true but WiFi.status() says otherwise (rare: driver wedge, silent RF failure), force DOWN state and schedule reconnect. Uses 0xFF disconnect reason so the event log distinguishes this path. - Forward-declare DeviceConfig in net_guard.h so consumers that don't call net_guard_start don't transitively pull config.h.