Offload admin backup/restore KDF to an App-CPU worker (OPT-008)
The /api/backup and /api/restore envelope KDF (600k PBKDF2 iterations,
~4.9 s at 240 MHz) ran inline on the Core-0 httpd task, stalling the
WiFi/lwIP stack that shares Core 0 for the whole derivation and
disassociating the admin station mid-backup.
Add a dedicated crypto worker pinned to APP_CPU (Core 1, priority 4),
used only in ADMIN_MODE where the UI core is idle. The backup/restore
handlers marshal the whole wrapExport()/unwrapExport() call onto the
worker and the httpd task blocks on a task notification, freeing Core 0
for WiFi while PBKDF2 runs on Core 1. The unlock path (crypto_task on
Core 0, pin_state) is untouched. When the worker is not running (native
tests, spawn failure) the job runs inline, preserving pre-offload
behavior. The worker widens the task watchdog and drops idle-core
monitoring around the bounded derivation, mirroring crypto_task.
Lifecycle is tied to AdminPortal::begin()/end(); end() is on the
deep-sleep teardown path, so no worker survives into deep sleep.
Verified on tdeck (ESP32-S3): PBKDF2BENCH 175k=8.137 us/iter,
600k=8.132 us/iter (baseline 8.137, within 0.06%); CRYPTOKAT PASS 6/6;
TASKS in ADMIN_MODE shows admincrypto on core=1 and kleidos-crypto still
on core=0. Native 1721/1721, clang-tidy 0, doxygen exit 0.
Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4