feat: port upstream OPDS improvements (PRs #1207, #1209)

Port two upstream PRs:

- PR #1207: Replace manual chunked download loop with
  HTTPClient::writeToStream via a FileWriteStream adapter, improving
  reliability for OPDS file downloads including chunked transfers.

- PR #1209: Add support for multiple OPDS servers with a new
  OpdsServerStore (JSON persistence with MAC-based password obfuscation),
  OpdsServerListActivity and OpdsSettingsActivity UIs, per-server
  credentials passed to HttpDownloader, web UI management endpoints,
  and migration from legacy single-server settings.

Made-with: Cursor

src/OpdsServerStore.cpp

@@ -0,0 +1,201 @@
+#include "OpdsServerStore.h"
+
+#include <ArduinoJson.h>
+#include <HalStorage.h>
+#include <Logging.h>
+#include <base64.h>
+#include <esp_mac.h>
+#include <mbedtls/base64.h>
+
+#include <cstring>
+
+#include "CrossPointSettings.h"
+
+OpdsServerStore OpdsServerStore::instance;
+
+namespace {
+constexpr char OPDS_FILE_JSON[] = "/.crosspoint/opds.json";
+constexpr size_t HW_KEY_LEN = 6;
+
+const uint8_t* getHwKey() {
+  static uint8_t key[HW_KEY_LEN] = {};
+  static bool initialized = false;
+  if (!initialized) {
+    esp_efuse_mac_get_default(key);
+    initialized = true;
+  }
+  return key;
+}
+
+void xorTransform(std::string& data) {
+  const uint8_t* key = getHwKey();
+  for (size_t i = 0; i < data.size(); i++) {
+    data[i] ^= key[i % HW_KEY_LEN];
+  }
+}
+
+String obfuscateToBase64(const std::string& plaintext) {
+  if (plaintext.empty()) return "";
+  std::string temp = plaintext;
+  xorTransform(temp);
+  return base64::encode(reinterpret_cast<const uint8_t*>(temp.data()), temp.size());
+}
+
+std::string deobfuscateFromBase64(const char* encoded, bool* ok) {
+  if (encoded == nullptr || encoded[0] == '\0') {
+    if (ok) *ok = false;
+    return "";
+  }
+  if (ok) *ok = true;
+  size_t encodedLen = strlen(encoded);
+  size_t decodedLen = 0;
+  int ret = mbedtls_base64_decode(nullptr, 0, &decodedLen, reinterpret_cast<const unsigned char*>(encoded), encodedLen);
+  if (ret != 0 && ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) {
+    LOG_ERR("OPS", "Base64 decode size query failed (ret=%d)", ret);
+    if (ok) *ok = false;
+    return "";
+  }
+  std::string result(decodedLen, '\0');
+  ret = mbedtls_base64_decode(reinterpret_cast<unsigned char*>(&result[0]), decodedLen, &decodedLen,
+                              reinterpret_cast<const unsigned char*>(encoded), encodedLen);
+  if (ret != 0) {
+    LOG_ERR("OPS", "Base64 decode failed (ret=%d)", ret);
+    if (ok) *ok = false;
+    return "";
+  }
+  result.resize(decodedLen);
+  xorTransform(result);
+  return result;
+}
+}  // namespace
+
+bool OpdsServerStore::saveToFile() const {
+  Storage.mkdir("/.crosspoint");
+
+  JsonDocument doc;
+  JsonArray arr = doc["servers"].to<JsonArray>();
+  for (const auto& server : servers) {
+    JsonObject obj = arr.add<JsonObject>();
+    obj["name"] = server.name;
+    obj["url"] = server.url;
+    obj["username"] = server.username;
+    obj["password_obf"] = obfuscateToBase64(server.password);
+  }
+
+  String json;
+  serializeJson(doc, json);
+  return Storage.writeFile(OPDS_FILE_JSON, json);
+}
+
+bool OpdsServerStore::loadFromFile() {
+  if (Storage.exists(OPDS_FILE_JSON)) {
+    String json = Storage.readFile(OPDS_FILE_JSON);
+    if (!json.isEmpty()) {
+      JsonDocument doc;
+      auto error = deserializeJson(doc, json.c_str());
+      if (error) {
+        LOG_ERR("OPS", "JSON parse error: %s", error.c_str());
+        return false;
+      }
+
+      servers.clear();
+      bool needsResave = false;
+      JsonArray arr = doc["servers"].as<JsonArray>();
+      for (JsonObject obj : arr) {
+        if (servers.size() >= MAX_SERVERS) break;
+        OpdsServer server;
+        server.name = obj["name"] | std::string("");
+        server.url = obj["url"] | std::string("");
+        server.username = obj["username"] | std::string("");
+
+        bool ok = false;
+        server.password = deobfuscateFromBase64(obj["password_obf"] | "", &ok);
+        if (!ok || server.password.empty()) {
+          server.password = obj["password"] | std::string("");
+          if (!server.password.empty()) needsResave = true;
+        }
+        servers.push_back(std::move(server));
+      }
+
+      LOG_DBG("OPS", "Loaded %zu OPDS servers from file", servers.size());
+
+      if (needsResave) {
+        LOG_DBG("OPS", "Resaving JSON with obfuscated passwords");
+        saveToFile();
+      }
+      return true;
+    }
+  }
+
+  // No opds.json found — attempt one-time migration from the legacy single-server
+  // fields in CrossPointSettings (opdsServerUrl/opdsUsername/opdsPassword).
+  if (migrateFromSettings()) {
+    LOG_DBG("OPS", "Migrated legacy OPDS settings");
+    return true;
+  }
+
+  return false;
+}
+
+bool OpdsServerStore::migrateFromSettings() {
+  if (strlen(SETTINGS.opdsServerUrl) == 0) {
+    return false;
+  }
+
+  OpdsServer server;
+  server.name = "OPDS Server";
+  server.url = SETTINGS.opdsServerUrl;
+  server.username = SETTINGS.opdsUsername;
+  server.password = SETTINGS.opdsPassword;
+  servers.push_back(std::move(server));
+
+  if (saveToFile()) {
+    SETTINGS.opdsServerUrl[0] = '\0';
+    SETTINGS.opdsUsername[0] = '\0';
+    SETTINGS.opdsPassword[0] = '\0';
+    SETTINGS.saveToFile();
+    LOG_DBG("OPS", "Migrated single-server OPDS config to opds.json");
+    return true;
+  }
+
+  servers.clear();
+  return false;
+}
+
+bool OpdsServerStore::addServer(const OpdsServer& server) {
+  if (servers.size() >= MAX_SERVERS) {
+    LOG_DBG("OPS", "Cannot add more servers, limit of %zu reached", MAX_SERVERS);
+    return false;
+  }
+
+  servers.push_back(server);
+  LOG_DBG("OPS", "Added server: %s", server.name.c_str());
+  return saveToFile();
+}
+
+bool OpdsServerStore::updateServer(size_t index, const OpdsServer& server) {
+  if (index >= servers.size()) {
+    return false;
+  }
+
+  servers[index] = server;
+  LOG_DBG("OPS", "Updated server: %s", server.name.c_str());
+  return saveToFile();
+}
+
+bool OpdsServerStore::removeServer(size_t index) {
+  if (index >= servers.size()) {
+    return false;
+  }
+
+  LOG_DBG("OPS", "Removed server: %s", servers[index].name.c_str());
+  servers.erase(servers.begin() + static_cast<ptrdiff_t>(index));
+  return saveToFile();
+}
+
+const OpdsServer* OpdsServerStore::getServer(size_t index) const {
+  if (index >= servers.size()) {
+    return nullptr;
+  }
+  return &servers[index];
+}