feat: implement RadiusService for guest management and configure mschap to return explicit authentication error codes

radiuscontroller/Services/RadiusService.cs

@@ -272,7 +272,8 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Remove Cleartext-Password and insert Auth-Type := Reject
+        // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth with MS-CHAP error 691,
+        // prompting iOS / clients to re-enter credentials instead of requiring 'Forget Network'.
         var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
         _db.RadCheck.RemoveRange(checks);
 

radiuscontroller/raddb/mods-enabled/mschap

@@ -0,0 +1,5 @@
+mschap {
+	# Send MS-CHAP-Error with E=691 on authentication failure,
+	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
+	send_error = yes
+}