0.3.9

Added

• Step-wise admin permissions. Beyond the existing security.admin_enabled (global on/off for the Admin
  screen), a new permissions config block scopes what's reachable inside Admin: permissions.settings
  (full / restricted / none) — restricted keeps only the basics editable (brightness, auto-dim, dim
  brightness, keyboard brightness, theme) and shows everything else read-only (no chevron); none makes all
  settings read-only. permissions.companion (default on) hides the Companion group (WiFi/USB/Bluetooth) when
  off — configured services still run. permissions.conversation_management (default off) is reserved for a
  future release (on-device add/edit/remove of contacts/channels/rooms; they stay read-only views for now). All
  three are provisionable from the config tool. Defaults are fully permissive, so existing configs are unchanged.
• Settings reorganised into per-section screens + Admin is now a pure hub. The on-device Admin screen no
  longer mixes settings, diagnostics and shortcuts — it's three labelled groups of links: Companion (WiFi /
  USB / Bluetooth), Conversations (Contacts / Channels / Rooms, read-only views), and Settings (Device,
  Radio, Display, Messaging, Sound, GPS, Battery, Security). Each section is its own screen mirroring the config
  tool, with all of its editable settings and its read-only diagnostics in one place (no more duplicated rows
  across Admin and Device Settings). Newly editable on-device: Radio (region preset picker — EU/UK/CH vs
  US/Canada — plus a TX-power slider and an advert-interval picker; frequency/SF/BW/CR/scope/path-hash stay read-only),
  Messaging (history, max-per-chat, location format, retries, telemetry request/badges/auto-refresh, canned
  messages, allow-mute), and GPS (enable, location-advert precision, timezone, clock offset, last-known max
  age). Offgrid mode and the live Heard-Adverts count now live at the top of the Radio screen. Each hub link
  carries an icon (gear for settings; @/#/R for contacts/channels/rooms; Wi-Fi/USB/Bluetooth for
  companion), and the 3rd-party licenses moved to an About block at the bottom of the hub. Radio/GPS changes
  reboot once on exit (same batched-save model as theme/language). The old single "Device Settings" screen is
  superseded by this layout.
• Selectable UI themes. Choose a color palette — Dark (default), Light, Amber (a "military"
  night mode that preserves night vision), or High contrast — on-device (Admin → Theme, reboots to apply)
  or via display.theme in config. Custom palettes can be defined under display.themes (start from a built-in
  base, override any color with #RRGGBB). Default appearance is unchanged. On/off switches now use the
  theme accent colour too. Thanks @jason-s13r (#24).
• Per-row Info + Map buttons on the Heard Adverts screen. Each heard node now has an explicit info (eye)
  button that opens its detail dialog, and — when the advert carries a location — a map button that opens the
  map centered on that node. Back now returns to the Admin screen. Thanks @jason-s13r (#15).
• Map screen pan buttons + windowed chrome. The map gains an on-screen D-pad (up/left/centre/right/down)
  alongside the existing drag-to-pan. On the T-Deck the map now keeps the status bar visible and uses the
  standard lv_win header with a back button (the T-Watch stays full-screen). Thanks @jason-s13r (#22, supersedes #20/#21).
• Uptime + last-charged in the Admin Battery section. Shows when the device booted (wall-clock + relative)
  and when charging last stopped (with the level at the time). Thanks @jason-s13r (#23).
• On-device Device Settings. A new editable settings screen (Admin → Device Settings, behind the existing
  admin.enabled gate) for changing device name, boot text, language, theme, security (lock mode / auto-lock /
  PIN), sound (SOS keyword/repeat, low-battery alert), and display (brightness, auto-dim, keyboard backlight,
  emoji, screenshots) directly on the device — no config-tool round-trip needed. Thanks @jason-s13r (#27). The theme picker now lives here (removed from the read-only Admin info screen).
• Mention tag uses square brackets — tapping a sender's name inserts @[name] so names with spaces stay
  intact. Thanks @jason-s13r (#26).

Changed

• Device Settings saves once on exit. Edits update the device live (brightness, etc.) but the SD write is
  now batched — config.json is written a single time when you leave the screen, instead of on every change.
  Theme/language changes reboot once on exit (toast on selection) rather than immediately, so you can change
  several settings and apply them together.
• Translation files now carry a release version ("version", e.g. 39 for 0.3.9). On boot the firmware
  logs a serial warning if a loaded language file is older than the firmware's string set, so missing
  translations (English fallback) are diagnosable — re-export the lang files from the config tool to refresh.
• Auto GPS refresh now defaults off (messaging.auto_telemetry). A fresh device no longer emits periodic
  telemetry requests on the mesh unless you opt in — quiet by default, matching the advert changes in 0.3.8.
  Existing configs that set the field are unaffected.
• Standardized screen chrome. The Admin, WiFi, USB, and Bluetooth screens now use the same windowed
  header with a left-arrow back button as the rest of the UI. Back from a companion/WiFi screen returns to
  Admin; back from Admin returns to the conversation list. Thanks @jason-s13r (#16–#19).
• Conversation-list row icon order now matches the status bar — mute · GPS · battery · last-seen eye ·
  time, with the time pinned to the right edge so the times line up in a column down the list.