feat: Pi hotspot SSID/password configurable from Settings page

- Settings page: SSID + password fields in In-car access card
- GET /api/hotspot reads current SSID (password never returned)
- POST /api/hotspot updates via nmcli (Hotspot-local profile on wlan0)
- deploy/yaris-hotspot.sudoers for privileged nmcli access
- Password is write-only with placeholder hint

templates/settings.html

@@ -146,6 +146,20 @@
             <p class="text-primary m-0 fw-bold small">In-car access</p>
         </div>
         <div class="card-body py-3">
+            <div class="row g-3 mb-3">
+                <div class="col-sm-6">
+                    <label class="form-label form-label-sm" for="ap-ssid">Pi hotspot name (SSID)</label>
+                    <input class="form-control form-control-sm" id="ap-ssid" maxlength="32" autocomplete="off">
+                </div>
+                <div class="col-sm-6">
+                    <label class="form-label form-label-sm" for="ap-password">Pi hotspot password</label>
+                    <input class="form-control form-control-sm" id="ap-password" type="password"
+                           minlength="8" maxlength="63" autocomplete="new-password" placeholder="Leave blank to keep current">
+                    <div class="form-text">Write-only — never sent back to the browser.</div>
+                </div>
+            </div>
+            <button class="btn btn-sm btn-outline-primary mb-3" id="ap-save" type="button">Save hotspot</button>
+            <div id="ap-message" class="alert py-2 mb-3" role="status" hidden></div>
             <div id="in-car-hotspot-info" hidden>
                 <p class="mb-2 fw-semibold">Your phone can reach the Pi at:</p>
                 <div class="d-flex align-items-center gap-2 mb-3">