Add browser management report decoder

docs/management_decoder.md

@@ -0,0 +1,82 @@
+# Management report decoder
+
+Paste MGR1 management-report payloads or complete GroupData packets from a
+packet analyzer to read a radio's public management information. Everything,
+including password authentication and ACL decryption, happens locally in this
+browser. The report, password, and candidate public key are never uploaded.
+
+The public portion of a report is deliberately plaintext, but it is **not
+authenticated** until a management password is supplied. A password-authenticated
+page proves that its public fields and encrypted ACL bytes have not been altered
+by someone who does not know that password.
+
+## Decode a management report
+
+<div class="management-tool" data-management-decoder>
+  <label for="management-packet-input">MGR1 payload or complete GroupData packet hex</label>
+  <textarea
+    id="management-packet-input"
+    data-role="input"
+    spellcheck="false"
+    autocomplete="off"
+    placeholder="Paste analyzer Raw Data, canonical MGR1 payload hex, or one MQTT raw value per line"
+    aria-describedby="management-packet-help"
+  ></textarea>
+  <p class="management-help" id="management-packet-help">
+    Spaces, line breaks, colons, dashes, <code>0x</code>, and MQTT JSON fields named
+    <code>raw</code> or <code>data</code> are accepted. Paste all pages from one report
+    together to view a complete multi-page ACL. Press Ctrl/Command+Enter to decode.
+  </p>
+
+  <label for="management-password-input">Management password <span>(optional for public fields; required for ACLs)</span></label>
+  <input id="management-password-input" data-role="password" type="password" autocomplete="new-password">
+  <p class="management-help">
+    The password remains in this page only. The decoder derives the MGR1 AES-SIV key in
+    your browser and does not send it anywhere.
+  </p>
+
+  <label for="management-candidate-input">Candidate administrator public key <span>(optional)</span></label>
+  <input id="management-candidate-input" data-role="candidate" type="text" autocomplete="off" spellcheck="false" placeholder="64 hexadecimal characters">
+  <p class="management-help">
+    ACL encryption reveals per-radio 12-byte fingerprints, not recoverable public keys.
+    Supplying a complete candidate key checks whether its fingerprint appears in this report.
+  </p>
+
+  <div class="management-actions">
+    <button class="management-primary-action" type="button" data-role="decode">Decode management report</button>
+    <button type="button" data-role="clear">Clear local data</button>
+    <button type="button" data-role="example">Load authenticated example</button>
+  </div>
+
+  <div class="management-error" data-role="error" role="alert" aria-live="polite" hidden></div>
+
+  <section class="management-results" data-role="results" aria-live="polite" hidden>
+    <div class="management-status" data-role="status"></div>
+    <dl class="management-summary" data-role="summary"></dl>
+    <div class="management-warnings" data-role="warnings" hidden>
+      <strong>Decode notes</strong>
+      <ul data-role="warning-list"></ul>
+    </div>
+    <h2>Encrypted ACL entries</h2>
+    <div class="management-table-wrap">
+      <table class="management-table" data-role="acl-table"></table>
+    </div>
+  </section>
+</div>
+
+## What the decoder accepts
+
+- Complete `PAYLOAD_TYPE_GRP_DATA` (`0x06`) analyzer/MQTT packet hex. It checks
+  the MeshCore route header, encoded path length, MGR1 page bounds, and required
+  zero padding.
+- A canonical MGR1 payload beginning with `4D475231` (`MGR1`).
+- One raw packet or canonical payload per line; duplicate observations of an
+  identical page are deduplicated.
+
+Use the same password configured by `set mgmt.password`. A decoded ACL lists
+the report-specific fingerprints and the administrator and/or OTA-signer flags.
+It cannot turn a fingerprint back into a full key. Use the optional candidate
+field to test a specific full public key.
+
+For the report schedule, public-field layout, cryptographic design, and the
+offline Python capture tool, see [Management reports](management_reports.md).