Release PWMenu 1.3.7

[newfpv]

What changed

• Fully integrated WPA-sec uploads and result downloads into PWMenu, including persistent per-BSSID history, stock-plugin migration, best-capture selection, atomic potfile downloads, manual sync, and status reporting.
• Added cryptographic aircrack-ng verification for every manually added or edited password.
• Added exact per-handshake map placement with a fixed center pin, existing-cluster placement, Map versus GPS provenance, and live password/map actions without page reloads.
• Changed password TXT export to sorted UTF-8 TSV with BOM, CRLF lines, explicit ESSID/BSSID/PASSWORD/SOURCE columns, and lossless colon-containing passwords.
• Made whitelist actions preserve exact SSID punctuation, update in place, and collapse only after more than 15 entries.
• Hardened OHC deduplication before queueing by comparing BSSIDs with the last imported task export, persistent local hash history, and live list_tasks; only one best unresolved capture per AP can enter the queue.
• Added an optional OHC-only VLESS route through a loopback Xray HTTP proxy, including an explicit flow override for provider links that do not match server-side account settings.
• Added clickable OHC/WPA-sec links, corrected duplicate-filename capture identity handling, expanded configuration documentation, and added regression coverage.

Root causes fixed

OHC candidates were previously placed in the persistent queue before export/history reconciliation, so the UI could show already submitted APs as queued and retries could revisit them. WPA-sec functionality was split across standalone plugins with overlapping state. Manual password storage trusted user input without proving that the key matched a capture. Legacy filenames and punctuation-normalized aliases also caused AP identity drift across exports, whitelist entries, and map actions.

Impact

PWMenu now owns the full WPA-sec lifecycle, refuses incorrect manual passwords, keeps exact handshake identity across the map and exports, and prevents known OHC tasks from entering the queue. Users in jurisdictions where the authenticated OHC API is unavailable can route only OHC through a configured VLESS link without proxying Pwnagotchi, bettercap, GPS, WPA-sec, or other traffic.

Validation

• 49 unit tests passed in the real Pwnagotchi Python environment.
• Secret scan passed; no API key, real VLESS URL, UUID, public key, device password, or device address is present in the commit.
• Live authenticated OHC check: direct API returned jurisdiction 403; OHC-only VLESS returned HTTP 200, success=True, and 308 tasks.
• Live persistent queue reconciliation reduced 127 queued files to 6 candidates and then to 0 after those six BSSIDs were found in OHC; no duplicate submission occurred.
• Live Pwnagotchi status: service active, Web UI HTTP 200, Xray bound only to 127.0.0.1, and zero service restarts.