[flowcool]

Problem

The generic examples expose a public fallback access point and allow the remote package's OTA password substitution to remain unset. The ESPHome schema accepts the unresolved substitution as a literal, so the missing credential is not rejected at configuration load time.

Change

• Remove the public AP fallback from the generic core; a device must provide its Wi-Fi credentials.
• Remove the empty OTA password default and require each device example to provide an explicit secret.
• Add a compile-time guard that rejects an empty or unresolved ota_password.
• Document the migration and keep the standalone example independent from the fork inventory.

This contribution contains no fleet inventory, Home Assistant state, NAS path, or device-specific value. The guard performs no runtime action.

Validation

• 75 isolated tests, including the OTA credential contract.
• ESPHome 2026.10 isolated MQTT firmware build with a synthetic OTA secret.
• Synthetic C++ checks prove explicit values pass and empty/unresolved values fail.
• Public API and MQTT examples validate with synthetic local secrets.

Refs #42