fix(network): read AP security flags in WiFi scan and unit-test parseAccessPoint

parseAccessPoint() is extracted from an anonymous namespace so the pure
property->AccessPointInfo mapping is testable. getAccessPoints() now reads
the Flags/WpaFlags/RsnFlags properties (they were never read, so every
network was reported Open and connections lacked a security section) and
fixes the double container-enter on the SSID 'ay' read that silently
emptied the scan list.

AGENTS.md

@@ -61,16 +61,27 @@ Two frameworks coexist:
   `find_package` requirement; the build fails without it.
 
 Test targets: `tests`, `test_assets`, `test_provisioning`, `test_network_unit`,
-`test_config`, `test_db`, `test_proclamation_sync`, `test_api_client`,
-`test_license_service`, `test_license_status`, `test_validation`,
-`test_date_format`, `test_timezone`, `test_logger`, `test_audio`,
-`test_audio_downloader`, `test_fibonacci_pattern`, `test_scroller_streams`,
-`test_fibonacci_scrambler`, `test_color_palettes`.
+`test_nm_device`, `test_config`, `test_db`, `test_proclamation_sync`,
+`test_api_client`, `test_license_service`, `test_license_status`,
+`test_validation`, `test_date_format`, `test_timezone`, `test_logger`,
+`test_audio`, `test_audio_downloader`, `test_fibonacci_pattern`,
+`test_scroller_streams`, `test_fibonacci_scrambler`, `test_color_palettes`.
+
+`test_nm_device` covers the pure `parseAccessPoint()` mapping; the sd-bus reads
+in `WifiDevice::getAccessPoints()` are Linux-only and verified live. Do not
+wrap the per-AP `ay` SSID property read in `sd_bus_message_enter_container()`
+before `sd_bus_message_read_array()` — `read_array` enters/exits the array
+itself, and the double-enter silently empties the scan list (see
+`src/network/nm_device.cpp`).
 
 New test files must be registered as a new `add_executable` target in
 `CMakeLists.txt` (there is no glob). `test_assets` must pass before committing —
 it checks the font and image files exist.
 
+`test_api_client` and `test_license_service` include "Live" tests that hit the
+portal unconditionally — they are excluded from the Nix `checkPhase` offline
+suite and need the `RWT_LIVE_*` secrets to pass.
+
 ---
 
 ## Runtime data & keys