wiki: record JWT key open question; defer ESP32 controller

- open-questions #7: symmetric vs. asymmetric JWT signing key (from the
  commit security review). Prefer RS256/EdDSA so verifying hosts hold only a
  public key — mirrors the ATECC608 / challenge-response "public key only"
  property. Decide before multi-host/multi-lane deployment.
- Mark esp32-custom-controller status: deferred per decision not to build
  device-level auth now; access control stays on UHPPOTE + network isolation
  (noted in open-questions #6).
- local-jwt-auth: document hardened secret handling + 8h expiry and the
  asymmetric-key pointer.
- Update index.md and append a log.md entry.

wiki/index.md

@@ -64,4 +64,4 @@ Counts: 1 source · 14 entities · 10 concepts · 2 decision records.
 
 ## Decisions
 - [[standing-decisions]] — settled decisions (stack, platform, integrity, access control, readers).
-- [[open-questions]] — 6 unsettled items that drive procurement.
+- [[open-questions]] — 7 open items (6 procurement + JWT key choice); ESP32 device auth deferred.