openhop/repeater: fixes from first real deploy on ubuntuHEADmain

- create spi/gpio groups and udev device rules (Raspberry Pi OS ships them, Ubuntu does not)
- hardware CS via spidev (cs_pin -1); a manual cs_pin on a kernel-owned CE line fails EBUSY
- align RAK6421 pin maps with upstream's hardware catalog: en_pins for the FEM enables,
  gpiod backend on chip 0 (catalog says chip 1, wrong for Pi 4)
- us RF preset is now MeshCore USA/Canada (Recommended): 910.525 / SF7 / BW62.5 / CR5
- set storage.storage_dir; omit mqtt_brokers entirely (any key enables the MQTT pusher)
- fetch radio-settings/radio-presets json into the data dir (pip omits them and the web
  setup wizard's hardware step is empty without them)
- config deployed 0660 with a vaultable repeater.security block so the daemon can persist
  credentials and re-templates no longer wipe them
- sudoers rule so the web UI can restart the service after config changes

3 files changed, 30 insertions, 9 deletions

diff --git a/openhop/repeater/vars/boards/rak6421-slot1.yaml b/openhop/repeater/vars/boards/rak6421-slot1.yaml
index 464a194..c49ea9a 100644
--- a/openhop/repeater/vars/boards/rak6421-slot1.yaml
+++ b/openhop/repeater/vars/boards/rak6421-slot1.yaml
@@ -3,13 +3,23 @@
 # Source: meshtastic/firmware bin/config.d/lora-RAK6421-13302-slot1.yaml
 repeater_sx1262_bus_id: 0            # spidev0.0
 repeater_sx1262_cs_id: 0            # CE0 (BCM 8)
-repeater_sx1262_cs_pin: 8
+# -1 = hardware CS via spidev. The kernel spi driver owns the CE line, so a
+# manual cs_pin here fails with EBUSY; manual CS is only for boards whose NSS
+# is wired to a non-CE GPIO (e.g. Waveshare).
+repeater_sx1262_cs_pin: -1
 repeater_sx1262_reset_pin: 16
 repeater_sx1262_busy_pin: 24
 repeater_sx1262_irq_pin: 22          # DIO1
 repeater_sx1262_use_dio3_tcxo: true
 repeater_sx1262_dio3_tcxo_voltage: 1.8
 repeater_sx1262_use_dio2_rf: true
-repeater_sx1262_txen_pin: 12         # SKY66122 FEM enable (verify TX vs RX)
-repeater_sx1262_rxen_pin: 13         # SKY66122 FEM enable (verify TX vs RX)
+# Per upstream's hardware catalog for this board: both SKY66122 FEM enables are
+# asserted together via en_pins and DIO2 does the actual TX/RX switching.
+repeater_sx1262_txen_pin: -1
+repeater_sx1262_rxen_pin: -1
+repeater_sx1262_en_pins: [12, 13]
+repeater_sx1262_use_gpiod_backend: true
+# Upstream's catalog says gpio_chip 1, but on a Pi 4 the 40-pin header is
+# gpiochip0 (chip 1 is the 8-line firmware expansion GPIO).
+repeater_sx1262_gpio_chip: 0
 repeater_sx1262_is_waveshare: false
diff --git a/openhop/repeater/vars/boards/rak6421-slot2.yaml b/openhop/repeater/vars/boards/rak6421-slot2.yaml
index 71a5fb9..ce03662 100644
--- a/openhop/repeater/vars/boards/rak6421-slot2.yaml
+++ b/openhop/repeater/vars/boards/rak6421-slot2.yaml
@@ -3,13 +3,23 @@
 # Source: meshtastic/firmware bin/config.d/lora-RAK6421-13302-slot2.yaml
 repeater_sx1262_bus_id: 0            # spidev0.1
 repeater_sx1262_cs_id: 1            # CE1 (BCM 7)
-repeater_sx1262_cs_pin: 7
+# -1 = hardware CS via spidev. The kernel spi driver owns the CE line, so a
+# manual cs_pin here fails with EBUSY; manual CS is only for boards whose NSS
+# is wired to a non-CE GPIO (e.g. Waveshare).
+repeater_sx1262_cs_pin: -1
 repeater_sx1262_reset_pin: 24
 repeater_sx1262_busy_pin: 19
 repeater_sx1262_irq_pin: 18          # DIO1
 repeater_sx1262_use_dio3_tcxo: true
 repeater_sx1262_dio3_tcxo_voltage: 1.8
 repeater_sx1262_use_dio2_rf: true
-repeater_sx1262_txen_pin: 26         # SKY66122 FEM enable (verify TX vs RX)
-repeater_sx1262_rxen_pin: 23         # SKY66122 FEM enable (verify TX vs RX)
+# Per upstream's hardware catalog for this board: both SKY66122 FEM enables are
+# asserted together via en_pins and DIO2 does the actual TX/RX switching.
+repeater_sx1262_txen_pin: -1
+repeater_sx1262_rxen_pin: -1
+repeater_sx1262_en_pins: [26, 23]
+repeater_sx1262_use_gpiod_backend: true
+# Upstream's catalog says gpio_chip 1, but on a Pi 4 the 40-pin header is
+# gpiochip0 (chip 1 is the 8-line firmware expansion GPIO).
+repeater_sx1262_gpio_chip: 0
 repeater_sx1262_is_waveshare: false
diff --git a/openhop/repeater/vars/rf/us.yaml b/openhop/repeater/vars/rf/us.yaml
index e20b1c6..2eecc99 100644
--- a/openhop/repeater/vars/rf/us.yaml
+++ b/openhop/repeater/vars/rf/us.yaml
@@ -1,11 +1,12 @@
 ---
-# MeshCore US 902-928 MHz preset.
+# MeshCore "USA/Canada (Recommended)" community preset: 910.525 / SF7 / BW62.5
+# / CR5. The wide alternate is SF11 / BW250 / CR5.
 # WARNING: every node on your mesh MUST share identical frequency / bandwidth /
 #          spreading_factor / coding_rate. Confirm these against your local
 #          MeshCore US community settings before deploying.
 repeater_frequency_hz: 910525000     # 910.525 MHz
-repeater_bandwidth_hz: 250000
-repeater_spreading_factor: 11        # 7-12
+repeater_bandwidth_hz: 62500
+repeater_spreading_factor: 7         # 7-12
 repeater_coding_rate: 5              # 5-8
 repeater_preamble_length: 32
 repeater_tx_power_dbm: 22            # SX1262 register max; SKY66122 boosts to ~1W