Merge fix/improve-error-logging: Human-readable MQTT errors

- Add TLS security warning when certificate verification is disabled
- Add getMQTTErrorString() to translate PubSubClient error codes
- Show broker/user info on connection failure for debugging
- Standardize log prefix to [MQTT] (was inconsistent [MQTTS])
- Use transport-agnostic "Network" instead of "WiFi" in messages
- Fix WiFiState/NetworkState enum mismatch in getWiFiStatus()

Error codes now show meaningful messages like:
  "Bad credentials (check username/password)" instead of "rc=4"

src/MQTTBridge.cpp

@@ -46,10 +46,11 @@ void MQTTBridge::begin(const MQTTConfig& config, const uint8_t* self_pubkey) {
   if (_config.use_tls) {
     _wifi_client_secure.setInsecure();  // Skip cert verification
     _mqtt_client.setClient(_wifi_client_secure);
-    Serial.printf("[MQTT] TLS enabled\n");
+    Serial.println("[MQTT] TLS enabled");
+    Serial.println("[MQTT] WARNING: Certificate verification DISABLED - vulnerable to MITM attacks!");
   } else {
     _mqtt_client.setClient(_wifi_client);
-    Serial.printf("[MQTT] Plain TCP\n");
+    Serial.println("[MQTT] Plain TCP (no encryption)");
   }
 
   _mqtt_client.setServer(_config.broker, _config.port);
@@ -74,7 +75,7 @@ void MQTTBridge::loop() {
   if (!_network->isConnected()) {
     if (_state == MQTTState::CONNECTED) {
       _state = MQTTState::DISCONNECTED;
-      Serial.println("[MQTTS] WiFi lost, disconnected");
+      Serial.println("[MQTT] Network connection lost, disconnecting");
     }
     return;
   }
@@ -93,7 +94,7 @@ void MQTTBridge::loop() {
     case MQTTState::CONNECTED:
       if (!_mqtt_client.connected()) {
         _state = MQTTState::DISCONNECTED;
-        Serial.println("[MQTTS] Connection lost");
+        Serial.println("[MQTT] Connection lost");
         _last_connect_attempt = millis();
         // Don't reset backoff on connection loss - broker might be down
       } else {
@@ -129,7 +130,7 @@ void MQTTBridge::end() {
 
   _state = MQTTState::DISCONNECTED;
   _initialized = false;
-  Serial.println("[MQTTS] Stopped");
+  Serial.println("[MQTT] Stopped");
 }
 
 void MQTTBridge::attemptConnection() {
@@ -138,7 +139,7 @@ void MQTTBridge::attemptConnection() {
   _state = MQTTState::CONNECTING;
   _last_connect_attempt = millis();
 
-  Serial.printf("[MQTTS] Connecting to %s:%d (backoff=%lums)...\n",
+  Serial.printf("[MQTT] Connecting to %s:%d (backoff=%lums)...\n",
                 _config.broker, _config.port, _current_backoff_ms);
 
   String client_id = String(_config.client_id);
@@ -164,14 +165,17 @@ void MQTTBridge::attemptConnection() {
     _reconnect_count++;
     // Reset backoff on successful connection
     _current_backoff_ms = BACKOFF_MIN_MS;
-    Serial.println("[MQTTS] Connected!");
+    Serial.println("[MQTT] Connected!");
 
     subscribeToCommands();
     publishStatus();
     _last_status_publish = millis();
   } else {
     int rc = _mqtt_client.state();
-    Serial.printf("[MQTTS] Connection failed, rc=%d\n", rc);
+    const char* error_str = getMQTTErrorString(rc);
+    Serial.printf("[MQTT] Connection failed: %s (code %d)\n", error_str, rc);
+    Serial.printf("[MQTT] Broker: %s:%d, User: %s\n", _config.broker, _config.port,
+                  strlen(_config.user) > 0 ? _config.user : "(none)");
     _state = MQTTState::ERROR;
 
     // Exponential backoff: double the delay (up to max)
@@ -180,6 +184,23 @@ void MQTTBridge::attemptConnection() {
   }
 }
 
+const char* MQTTBridge::getMQTTErrorString(int rc) {
+  // PubSubClient state() return codes
+  switch (rc) {
+    case -4: return "Connection timeout";
+    case -3: return "Connection lost";
+    case -2: return "Connect failed (network)";
+    case -1: return "Disconnected cleanly";
+    case 0:  return "Connected";
+    case 1:  return "Bad protocol version";
+    case 2:  return "Client ID rejected";
+    case 3:  return "Server unavailable";
+    case 4:  return "Bad credentials (check username/password)";
+    case 5:  return "Not authorized";
+    default: return "Unknown error";
+  }
+}
+
 void MQTTBridge::setupTopics() {
   snprintf(_topic_status, sizeof(_topic_status),
            "%s/gateway/%s/status", _config.topic_prefix, _gateway_id);
@@ -199,7 +220,7 @@ void MQTTBridge::subscribeToCommands() {
   char topic[100];
   snprintf(topic, sizeof(topic), "%s#", _topic_cmd_prefix);
   _mqtt_client.subscribe(topic);
-  Serial.printf("[MQTTS] Subscribed to: %s\n", topic);
+  Serial.printf("[MQTT] Subscribed to: %s\n", topic);
 }
 
 void MQTTBridge::updateConfig(const MQTTConfig& config) {
@@ -344,7 +365,7 @@ void MQTTBridge::publishMessage(const char* topic, const char* payload, bool ret
   if (_mqtt_client.publish(topic, payload, retained)) {
     _messages_sent++;
   } else {
-    Serial.printf("[MQTTS] Publish failed to %s\n", topic);
+    Serial.printf("[MQTT] Publish failed to %s\n", topic);
   }
 }
 
@@ -391,10 +412,10 @@ void MQTTBridge::handleMessage(char* topic, uint8_t* payload, unsigned int lengt
 
   if (strncmp(topic, _topic_cmd_prefix, strlen(_topic_cmd_prefix)) == 0) {
     const char* cmd = topic + strlen(_topic_cmd_prefix);
-    Serial.printf("[MQTTS] Command received: %s\n", cmd);
+    Serial.printf("[MQTT] Command received: %s\n", cmd);
 
     if (strcmp(cmd, "reboot") == 0) {
-      Serial.println("[MQTTS] Reboot requested");
+      Serial.println("[MQTT] Reboot requested");
       publishStatus();
       delay(100);
       ESP.restart();

src/MQTTBridge.h

@@ -117,6 +117,9 @@ private:
   void publishMessage(const char* topic, const char* payload, bool retained = false);
   void publishJson(const char* topic, JsonDocument& doc, bool retained = false);
 
+  // Error code translation for better diagnostics
+  static const char* getMQTTErrorString(int rc);
+
   static uint32_t fnv1a_hash(const uint8_t* data, size_t len);
   bool isDuplicate(const uint8_t* data, size_t len);
 

src/MyMesh.cpp

@@ -733,6 +733,21 @@ MyMesh::MyMesh(mesh::MainBoard &board, mesh::Radio &radio, mesh::MillisecondCloc
   _prefs.adc_multiplier = 0.0f; // 0.0f means use default board multiplier
 }
 
+MyMesh::~MyMesh() {
+  // Clean up dynamically allocated resources
+#ifdef WITH_MQTT
+  delete _web_config;
+  _web_config = nullptr;
+  delete _mqtt_bridge;
+  _mqtt_bridge = nullptr;
+#endif
+
+#ifdef WITH_ETHERNET
+  delete _mqtt_bridge;
+  _mqtt_bridge = nullptr;
+#endif
+}
+
 void MyMesh::begin(FILESYSTEM *fs) {
   mesh::Mesh::begin();
   _fs = fs;

src/MyMesh.h

@@ -125,21 +125,21 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks {
 
 #ifdef WITH_MQTT
   WiFiManager _wifi_mgr;
-  MQTTBridge* _mqtt_bridge;
+  MQTTBridge* _mqtt_bridge = nullptr;
-  WebConfig* _web_config;
+  WebConfig* _web_config = nullptr;
   WiFiConfig _wifi_config;
   MQTTConfig _mqtt_config;
-  unsigned long _last_mqtt_stats;
+  unsigned long _last_mqtt_stats = 0;
 
   void initMQTT();
 #endif
 
 #ifdef WITH_ETHERNET
   EthernetManager _eth_mgr;
-  MQTTBridge* _mqtt_bridge;
+  MQTTBridge* _mqtt_bridge = nullptr;
   MQTTConfig _mqtt_config;
   EthernetConfig _eth_config;
-  unsigned long _last_mqtt_stats;
+  unsigned long _last_mqtt_stats = 0;
 
   void initEthernet();
 #endif
@@ -196,6 +196,7 @@ protected:
 
 public:
   MyMesh(mesh::MainBoard& board, mesh::Radio& radio, mesh::MillisecondClock& ms, mesh::RNG& rng, mesh::RTCClock& rtc, mesh::MeshTables& tables);
+  ~MyMesh();  // Clean up dynamically allocated resources
 
   void begin(FILESYSTEM* fs);
 

src/WiFiManager.cpp

@@ -10,6 +10,7 @@ WiFiManager::WiFiManager()
       _retry_count(0),
       _initialized(false) {
   memset(&_config, 0, sizeof(_config));
+  memset(_cached_ssid, 0, sizeof(_cached_ssid));
 }
 
 void WiFiManager::begin(const WiFiConfig& config) {
@@ -82,6 +83,9 @@ void WiFiManager::loop() {
         _state = WiFiState::CONNECTED;
         _connected_since = millis();
         _retry_count = 0;
+        // Cache SSID to avoid dangling pointer from WiFi.SSID().c_str()
+        strncpy(_cached_ssid, WiFi.SSID().c_str(), sizeof(_cached_ssid) - 1);
+        _cached_ssid[sizeof(_cached_ssid) - 1] = '\0';
         Serial.printf("[WiFi] Connected! IP: %s, RSSI: %d dBm\n",
                       WiFi.localIP().toString().c_str(), WiFi.RSSI());
       } else if (status == WL_NO_SSID_AVAIL) {
@@ -184,6 +188,9 @@ void WiFiManager::startAPMode() {
 
   if (success) {
     _state = WiFiState::AP_MODE;
+    // Cache AP SSID to avoid dangling pointer
+    strncpy(_cached_ssid, ap_ssid.c_str(), sizeof(_cached_ssid) - 1);
+    _cached_ssid[sizeof(_cached_ssid) - 1] = '\0';
     Serial.printf("[WiFi] AP started: SSID='%s', IP=%s\n",
                   ap_ssid.c_str(), WiFi.softAPIP().toString().c_str());
   } else {
@@ -221,10 +228,8 @@ int32_t WiFiManager::getRSSI() const {
 }
 
 const char* WiFiManager::getSSID() const {
-  if (_state == WiFiState::CONNECTED) {
+  if (_state == WiFiState::CONNECTED || _state == WiFiState::AP_MODE) {
-    return WiFi.SSID().c_str();
+    return _cached_ssid;
-  } else if (_state == WiFiState::AP_MODE) {
-    return WiFi.softAPSSID().c_str();
   }
   return "";
 }
@@ -264,10 +269,8 @@ NetworkState WiFiManager::getState() const {
 }
 
 const char* WiFiManager::getConnectionName() const {
-  if (_state == WiFiState::CONNECTED) {
+  if (_state == WiFiState::CONNECTED || _state == WiFiState::AP_MODE) {
-    return WiFi.SSID().c_str();
+    return _cached_ssid;
-  } else if (_state == WiFiState::AP_MODE) {
-    return WiFi.softAPSSID().c_str();
   }
   return "Not connected";
 }

src/WiFiManager.h

@@ -61,6 +61,7 @@ private:
   unsigned long _connected_since;
   uint8_t _retry_count;
   bool _initialized;
+  char _cached_ssid[33];  // Cached SSID to avoid dangling pointer from WiFi.SSID().c_str()
 
   void attemptConnection();
   void checkConnection();