wildcard-probe signature + 31st OUI (DeFlockJoplin)

Adds Michael / DeFlockJoplin's high-precision detection method on top of
the NitekryDPaul baseline: a Flock camera is flagged when it transmits a
Probe Request (type=0 subtype=4) with a wildcard SSID IE (tag 0 len 0)
AND its addr2 matches the OUI list. Drive-test in Joplin: 11/12 cameras
caught with only 2 false positives.

- New AlertType ALERT_WILDCARD_PROBE, emitted as detection_method
  'wifi_wildcard_probe' (high-precision class)
- Wildcard-probe hits suppress the addr2 broad alert for the same frame
  to prevent double counting; non-probe OUI matches still emit as
  'wifi_oui_addr2'
- IE parser returns tri-state (1=wildcard / 0=directed / -1=no SSID IE),
  with FCS-trailer retry only on the -1 no-IE case
- addr1 receiver-side sleeper-catch and the optional addr3 + SSID paths
  are unchanged — wildcard is purely additive
- 31st OUI 82:6b:f2 added to target_ouis[] and to the dataset doc; it's
  the OUI of the 12th camera in Michael's drive-test that the original
  30 didn't catch
- README explains the wildcard-probe method, credits Michael with a link
  to github.com/DeflockJoplin/flock-you, and bumps Acknowledgments

Source: https://github.com/DeflockJoplin/flock-you

README.md

@@ -1,15 +1,21 @@
-# Flock-You: Promiscuous WiFi Edition (`promiscious` branch)
+# Flock-You: Promiscuous WiFi Edition (`promiscious-dev` branch)
 
 <img src="flock.png" alt="Flock You" width="300px">
 
 **Passive 2.4 GHz promiscuous-mode detector for Flock Safety surveillance infrastructure. Runs standalone or feeds the Flask dashboard over USB for live GPS-tagged wardriving.**
 
+> **Dev note:** This is the `promiscious-dev` branch — adds the
+> DeFlockJoplin wildcard-probe tightening and a 31st OUI on top of the
+> `promiscious` baseline. See "Further research" below.
+
 ---
 
 ## Credit
 
 All WiFi promiscuous detection research — the **30-OUI target list**, the **promiscuous-mode strategy**, and the **addr1-receiver detection technique** — is the work of **ØяĐöØцяöЪöяцฐ / @NitekryDPaul**. The firmware here is a mod of his original firmware with added SPIFFS persistence and Flask-dashboard integration. Full research writeup: [`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md).
 
+Additional research credit to **Michael / DeFlockJoplin** for the **wildcard-probe-request signature** and the 31st OUI (`82:6b:f2`). Field-tested to 11/12 cameras caught with only 2 false positives in Joplin. Source: [DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you).
+
 ---
 
 ## What this branch does
@@ -41,6 +47,26 @@ Both are applied before the OUI match. This whole approach, including the 30-OUI
 
 ---
 
+## Further research — the wildcard-probe signature (DeFlockJoplin)
+
+Michael / DeFlockJoplin used the OUI + addr1/addr2/addr3 work above as a starting point and characterised what Flock cameras actually do on the air. His finding:
+
+> The cameras are hopping channels and sending out a wildcard WiFi probe request on every channel. This specific type of request combined with OUI matching has created what seems to be a fairly unique signature.
+
+His drive-test in Joplin caught **11 of 12 cameras** with only **2 false positives**. The 12th camera was doing the same wildcard-probe behaviour but with an OUI (`82:6b:f2`) that wasn't in @NitekryDPaul's original 30 — it's now the 31st entry in our list, credited to him.
+
+The tightened signature that's active on this branch:
+
+1. Frame is 802.11 Management, type=0 subtype=4 (**Probe Request**)
+2. SSID Information Element (tag 0) is present with **length 0** (wildcard)
+3. `addr2` (transmitter) matches the known-OUI list
+
+When all three hit, we emit `detection_method: wifi_wildcard_probe` — the high-precision class. Non-probe frames from the same OUIs still emit `wifi_oui_addr2`, and the `addr1` receiver-side sleeper-catch still runs independently.
+
+His proof-of-concept firmware (different enough we're not just pulling it in wholesale, but the core idea carried over cleanly): [DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you). The wildcard-probe analysis is his; we ported the detection into this firmware and kept our SPIFFS persistence, Flask JSON emission, and audio/LED feedback on top.
+
+---
+
 ## Detection pipeline
 
 ```
@@ -78,7 +104,7 @@ The split between callback and loop is deliberate: the WiFi task has hard real-t
 
 ## OUI target list (@NitekryDPaul research)
 
-All lowercase, colon-separated. 30 Flock Safety infrastructure prefixes:
+All lowercase, colon-separated. 31 Flock Safety infrastructure prefixes:
 
 ```
 70:c9:4e   3c:91:80   d8:f3:bc   80:30:49   b8:35:32
@@ -87,6 +113,7 @@ All lowercase, colon-separated. 30 Flock Safety infrastructure prefixes:
 00:f4:8d   d0:39:57   e8:d0:fc   e0:4f:43   b8:1e:a4
 70:08:94   58:8e:81   ec:1b:bd   3c:71:bf   58:00:e3
 90:35:ea   5c:93:a2   64:6e:69   48:27:ea   a4:cf:12
+82:6b:f2   ← contributed by Michael / DeFlockJoplin
 ```
 
 Pre-compiled into a byte table in `setup()` so the matcher stays entirely in IRAM with no flash-resident lookups during callback execution.
@@ -133,7 +160,8 @@ The firmware emits one JSON line per detection in the same schema the BLE detect
 
 `detection_method` values:
 
-- `wifi_oui_addr2` — transmitter-side OUI match
+- `wifi_wildcard_probe` — **Probe Request + wildcard SSID from a known OUI** (the DeFlockJoplin high-precision signature). When this fires, the `addr2` broad alert is suppressed for the same frame to avoid double-counting.
+- `wifi_oui_addr2` — transmitter-side OUI match on any non-probe frame
 - `wifi_oui_addr1` — **receiver-side OUI match** (the @NitekryDPaul technique)
 - `wifi_oui_addr3` — BSSID OUI match (mgmt frames only; disabled by default)
 - `wifi_ssid` — SSID keyword match (disabled by default)
@@ -225,7 +253,8 @@ The BLE-only sibling of this firmware lives on the [`main` branch](https://githu
 
 ## Acknowledgments
 
-- **ØяĐöØцяöЪöяцฐ (@NitekryDPaul)** — **WiFi promiscuous detection research**: the 30-OUI Flock Safety target list and the addr1-receiver detection technique that are the entirety of this firmware. The code here is a mod of his original work.
+- **ØяĐöØцяöЪöяцฐ (@NitekryDPaul)** — **WiFi promiscuous detection research**: the 30-OUI Flock Safety target list and the addr1-receiver detection technique that are the baseline of this firmware. The code here is a mod of his original work.
+- **Michael / DeFlockJoplin** ([DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you), [deflockjoplin.today](https://deflockjoplin.today)) — **wildcard-probe-request signature** + the 31st OUI (`82:6b:f2`). Drive-tested in Joplin to 11/12 cameras caught with only 2 false positives.
 - **Will Greenberg** ([@wgreenberg](https://github.com/wgreenberg)) — BLE manufacturer company ID detection (`0x09C8` XUNTONG) sourced from his [flock-you](https://github.com/wgreenberg/flock-you) fork (used by the BLE companion on `main`)
 - **[DeFlock](https://deflock.me)** ([FoggedLens/deflock](https://github.com/FoggedLens/deflock)) — crowdsourced ALPR location data and detection methodologies. Datasets included in `datasets/`
 - **[GainSec](https://github.com/GainSec)** — Raven BLE service UUID dataset (`raven_configurations.json`) used by the BLE companion