fix: accept stock wireless/network shapes + carry write-only secrets through JSON Patch

[raspbeguy]

Summary

Closes out the remaining findings from the stricter-than-platform audit (the rest landed in #9). Four fixes:

reject_422 (validation stricter than the platform)

• wireless.devices country: stock x86 ships country='' (unset) and 6 GHz ships '00' (world domain). The schema pattern ^[A-Za-z]{2}$ rejected both. fromUci now coerces '' → null, and the pattern is ^([A-Za-z]{2}|00)$.
• wireless.interfaces encryption='owe': stock 6 GHz interfaces use OWE (Opportunistic Wireless Encryption, RFC 8110, keyless). It was missing from VALID_ENCRYPTION and would also have been forced to carry a key. Added owe, and a NO_KEY_ENCRYPTION set (none/wep/owe) so the key-required check skips it.
• network.devices type: config_generate emits anonymous config device options-override sections (name + macaddr, no type) on some targets. validate required type. Now optional (enum-checked only when present); openapi_required drops type.

JSON Patch write-only secret carry-forward

• A JSON Patch (RFC 6902) that doesn't touch a write-only secret no longer drops it. The post-image is built from the masked read view (has_key, not key), so a patch leaving the secret alone produced a post-image without it and tripped conditional-required validation ("key is required when encryption is …"). The write path now carries forward any writeOnly field the patch didn't set (key, preshared_key, private_key, tls_auth, pkcs12) — mirroring what the merge-patch path's merge_for_patch already did. A patch that explicitly sets a new secret is left intact (post[k] == null guard).

Tests

• Unit (network_wireless_test.uc): type-less device accepted; empty country → null; '00' accepted; owe accepted without a key.
• Unit (handler_test.uc): JSON Patch not touching the masked key preserves it (no spurious 422); JSON Patch setting a new key is not clobbered.

Verification

• make lint + make test (756 pass, +6) + make coverage (80.8% direct, 100% module) + make openapi-check (regenerated) all green.
• Adversarial review across all four fixes + the handler change returned SHIP (verified existing carries cleartext at both call sites, clobber guard holds, merge-patch path untouched, regex accepts only 00 numeric, type-less sections don't NPE or wrongly demand vid).

Notes

• wireless.* and network.devices type-less are excluded from the integration round-trip test (wireless needs hwsim; the CI VM's device section has a type), so these are verified by unit tests.
• owe-transition (mixed open/OWE) intentionally out of scope; this matches only the stock 6 GHz owe default.