Replace HMAC-SHA256 with AES-256-GCM + ECDH key exchange for BLE relay commands (issue #2)

- New: src/ecdh_helper.h — ECDH keypair gen, shared secret, pubkey HMAC sign/verify
- Server (src/main.cpp): ECDH handshake callback, AES-GCM decrypt, PSK from NVS
- Client (src/main.cpp→client.cpp): ECDH after connect, AES-GCM encrypt, PSK from NVS
- Android: ECDH (KeyAgreement) + AES-GCM (Cipher) in BleRelayManager.kt
- PSK provisioned via USB CDC SET_KEY (SettingsActivity.kt)
- PrefsHelper: hmac_key → psk
- Bumped versions: server=18, client=4
- NVS namespace: hmac→syl, key:hmac_key→psk
- BLE ECDH characteristic: beb5483e-...-f26dc (WRITE_NR|NOTIFY)

icon.svg

@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512">
+  <defs>
+    <filter id="glow" x="-20%" y="-20%" width="140%" height="140%">
+      <feGaussianBlur stdDeviation="12" result="blur" />
+      <feComposite in="SourceGraphic" in2="blur" operator="over" />
+    </filter>
+  </defs>
+
+  <!-- Achtergrond: Dark Antraciet Squircle -->
+  <rect x="32" y="32" width="448" height="448" rx="105" ry="105" fill="#121212" />
+  <rect x="32" y="32" width="448" height="448" rx="105" ry="105" fill="none" stroke="#2A2A32" stroke-width="4" />
+
+  <!-- Centrale Icon Groep met Gloed -->
+  <g filter="url(#glow)">
+    <!-- Power Cirkel (geopend aan de bovenkant) -->
+    <path d="M 186 210 A 110 110 0 1 0 326 210" 
+          fill="none" 
+          stroke="#00E5FF" 
+          stroke-width="28" 
+          stroke-linecap="round" />
+
+    <!-- Bluetooth Pijl / Power Pin -->
+    <path d="M 256 120 L 256 260 M 256 120 L 285 145 L 240 180 L 270 205 L 256 216" 
+          fill="none" 
+          stroke="#00E5FF" 
+          stroke-width="24" 
+          stroke-linecap="round" 
+          stroke-linejoin="round" />
+  </g>
+
+  <!-- Twee status-stippen voor Relais 1 & 2 -->
+  <circle cx="216" cy="370" r="10" fill="#00E5FF" opacity="0.8" />
+  <circle cx="296" cy="370" r="10" fill="#00E5FF" opacity="0.8" />
+</svg>