chore(sanitize): remove real device ID and personal LAN IPs from tracked files

Per the repo's no-real-data rule (CLAUDE.md), scrub committed files only (the
gitignored _/ local captures are left as-is):

- Real Bose-OUI device ID 08DF1F0BA325 -> placeholder AABBCCDDEE0A across 4 docs
  and 8 Go test files (consistent 1:1 rename; affected packages tested green).
- Personal/topology LAN IPs -> RFC-5737: the lab runbook's AP subnet
  192.168.10.x -> 198.51.100.x (192.0.2.x is already used contrastively there)
  and 192.168.100.1 -> 203.0.113.1; illustrative example IPs in
  ANONYMIZATION-SUMMARY / spotify-overview / TROUBLESHOOTING -> 192.0.2.x.
- Kept factual RFC-1918 range citations (10.0.0.0/8 trusted-proxy example,
  192.168.0.0/16 "all private subnets") since they name the ranges themselves.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/content/docs/analysis/ANONYMIZATION-SUMMARY.md

@@ -42,7 +42,7 @@ pattern) but stay numeric for parsers that expect integer-looking IDs.
 
 An earlier anonymisation pass used `192.168.1.x` as its target. That
 range is RFC-1918 private space — perfectly valid on real networks,
-which means a reader can't tell whether `192.168.1.10` is a
+which means a reader can't tell whether `192.0.2.10` is a
 placeholder or a documented LAN address. RFC-5737 ranges fix that:
 because they're reserved for documentation only, any reader knows on
 sight that they don't represent a real device.

docs/content/docs/analysis/BOSE-LAB-RUNBOOK.md

@@ -84,7 +84,7 @@ sudo tee /etc/systemd/network/08-wlan0.network << 'EOF'
 Name=wlan0
 
 [Network]
-Address=192.168.10.1/24
+Address=198.51.100.1/24
 IPForward=yes
 ConfigureWithoutCarrier=yes
 DHCP=no
@@ -104,7 +104,7 @@ sudo systemctl mask wpa_supplicant@wlan0
 **Verify:**
 ```bash
 ip addr show wlan0
-# Expected: ONLY inet 192.168.10.1/24 (NO second DHCP IP)
+# Expected: ONLY inet 198.51.100.1/24 (NO second DHCP IP)
 ```
 
 ---
@@ -151,9 +151,9 @@ sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
 
 sudo tee /etc/dnsmasq.conf << 'EOF'
 interface=wlan0
-dhcp-range=192.168.10.100,192.168.10.200,24h
-dhcp-option=3,192.168.10.1
-dhcp-option=6,192.168.10.1
+dhcp-range=198.51.100.100,198.51.100.200,24h
+dhcp-option=3,198.51.100.1
+dhcp-option=6,198.51.100.1
 
 # DNS Upstream: custom server on localhost (adjust port if necessary)
 server=127.0.0.1#5353    # Example: custom server on port 5353
@@ -237,7 +237,7 @@ If you cannot see the `Bose-Lab` SSID on your phone:
     ```bash
     sudo nmcli device set wlan0 managed no
     ```
-7.  **Ghost IP Conflict:** If `ip addr show wlan0` shows both `192.168.10.1` and another IP (like `192.0.2.x`), `hostapd` will fail. This is usually caused by NetworkManager managing the interface. Ensure you've run:
+7.  **Ghost IP Conflict:** If `ip addr show wlan0` shows both `198.51.100.1` and another IP (like `192.0.2.x`), `hostapd` will fail. This is usually caused by NetworkManager managing the interface. Ensure you've run:
     ```bash
     sudo nmcli device set wlan0 managed no
     # If the ghost IP is still there, remove it manually:
@@ -259,13 +259,13 @@ If you haven't created a CA yet, follow **Appendix A** first.
 # Temporarily make reachable via HTTP for easy download:
 cd /etc/my-dns-ca/
 python3 -m http.server 8080
-# → Reachable at http://192.168.10.1:8080/ca.crt
+# → Reachable at http://198.51.100.1:8080/ca.crt
 ```
 
 ### Install on Android
 
 1. Connect phone to `Bose-Lab`
-2. Open browser → `http://192.168.10.1:8080/ca.crt`
+2. Open browser → `http://198.51.100.1:8080/ca.crt`
 3. Download certificate
 4. **Settings → Security → Credentials → Install CA Certificate**
 5. Select certificate and confirm
@@ -322,7 +322,7 @@ sudo tcpdump -i wlan0 -n 'not port 53' -w /tmp/bose-nodns.pcap
 
 # Traffic of a specific host only (filter by phone IP)
 # Read phone IP from dnsmasq.leases beforehand (see below)
-sudo tcpdump -i wlan0 -n host 192.168.10.101
+sudo tcpdump -i wlan0 -n host 198.51.100.101
 ```
 
 ### Read SNI from TLS Traffic (without decryption)
@@ -351,7 +351,7 @@ Transfer `.pcap` files from the Pi to the PC:
 
 ```bash
 # From the PC (scp)
-scp pi@192.168.10.1:/tmp/bose-*.pcap ~/Desktop/
+scp pi@198.51.100.1:/tmp/bose-*.pcap ~/Desktop/
 ```
 
 **Important Wireshark Filters:**
@@ -607,7 +607,7 @@ You can either configure the macOS system proxy manually or use `mitmproxy`'s au
 **Method 1: System Proxy (Manual)**
 1.  Go to **System Settings → Network → Wi-Fi → Details... → Proxies**.
 2.  Enable **HTTP Proxy** and **HTTPS Proxy**.
-3.  Set Server to your Pi's IP (`192.168.10.1`) and Port to `8080`.
+3.  Set Server to your Pi's IP (`198.51.100.1`) and Port to `8080`.
 4.  Click **OK** and **Apply**.
 
 **Method 2: mitmproxy Local Redirect (Automatic)**
@@ -667,7 +667,7 @@ If the app uses **Certificate Pinning** (hardcoded hashes), even moving the CA t
 If the **Transparent AP** setup (Steps 1–6) is too complex or you are experiencing routing issues, you can use `mitmproxy` as a **Regular HTTP Proxy**.
 
 ### 1. How it works
-In this mode, the Pi acts as a simple server on port 8080. You tell your phone's Wi-Fi settings to send all traffic to `192.168.10.1:8080`.
+In this mode, the Pi acts as a simple server on port 8080. You tell your phone's Wi-Fi settings to send all traffic to `198.51.100.1:8080`.
 
 *   **Pros:** No complex `nftables` or NAT rules required.
 *   **Cons:** Many Android apps (and background processes) ignore system-wide proxy settings. **HTTPS still requires a trusted CA for decryption.**
@@ -683,7 +683,7 @@ mitmproxy --listen-port 8080
 1.  Go to **Settings → Wi-Fi → Bose-Lab**.
 2.  Select **Modify Network** (or the "i" icon).
 3.  Set **Proxy** to **Manual**.
-4.  **Proxy hostname:** `192.168.10.1`
+4.  **Proxy hostname:** `198.51.100.1`
 5.  **Proxy port:** `8080`
 6.  Save and try to browse a site.
 
@@ -706,7 +706,7 @@ go get github.com/google/gopacket
 go run scripts/extract-ws.go your_capture.pcap [filter_ip]
 
 # Example: Filter for a specific speaker's IP in WebSocket messages
-go run scripts/extract-ws.go capture.pcap 192.168.100.1
+go run scripts/extract-ws.go capture.pcap 203.0.113.1
 ```
 
 ### 2. Manual Extraction with tshark
@@ -889,5 +889,5 @@ pgrep -a tcpdump
 dig @127.0.0.1 -p 5353 global.api.bose.io
 
 # Check network connectivity from the phone (from the Pi)
-ping 192.168.10.101   # Phone IP from dnsmasq.leases
+ping 198.51.100.101   # Phone IP from dnsmasq.leases
 ```

docs/content/docs/appendix/device-lifecycle-and-power-on-enhancement.md

@@ -116,7 +116,7 @@ The system has distinct phases where device information is collected and enhance
 **Endpoint**: `POST /streaming/account/{accountId}/devices`
 **Request Format**:
 ```xml
-<device deviceid="08DF1F0BA325">
+<device deviceid="AABBCCDDEE0A">
     <name>Living Room Speaker</name>
 </device>
 ```

docs/content/docs/concepts/spotify-overview.md

@@ -91,7 +91,7 @@ that delegates to AfterTouch for these names). The implementation lives in
 
 > **IP-based `--server-url` is incompatible with OAuth (both Spotify and Amazon
 > Music).** The speaker's hostname construction appends `oauth` to the first
-> label only, so `192.168.0.30` would produce `192oauth.168.0.30` — malformed,
+> label only, so `192.0.2.30` would produce `192oauth.0.2.30` — malformed,
 > no DNS resolver will answer for it, and there is no clean workaround on the
 > AfterTouch side. **Use a real LAN hostname** before configuring Spotify or
 > Amazon Music. The Health-tab `oauth_target_reachable` check warns when this

docs/content/docs/guides/SOUNDTOUCH-SERVICE.md

@@ -390,7 +390,7 @@ Lists all discovered SoundTouch devices with their current status.
 ```json
 [
   {
-    "device_id": "08DF1F0BA325",
+    "device_id": "AABBCCDDEE0A",
     "name": "Living Room Speaker",
     "ip_address": "192.0.2.100",
     "product_code": "SoundTouch 20",

docs/content/docs/guides/TROUBLESHOOTING.md

@@ -1121,10 +1121,10 @@ In `vi`, find `block_remote_traffic()`. Press `i` to enter insert mode. After th
 first `done` line in that function, add:
 
 ```
-echo -A INPUT -i $IFACE -s 192.168.10.0/24 -j ACCEPT
+echo -A INPUT -i $IFACE -s 192.0.2.0/24 -j ACCEPT
 ```
 
-Replace `192.168.10.0/24` with the subnet your AfterTouch host is on. Press `Esc`,
+Replace `192.0.2.0/24` with the subnet your AfterTouch host is on. Press `Esc`,
 type `:wq`, press `Enter`, then reboot:
 
 ```bash

docs/content/docs/reference/DEVICE-PAIRING-FLOW.md

@@ -71,7 +71,7 @@ All subsequent messages (except `selectLastWiFiSource`, see below) use this enve
 ```
 
 `requestID` is a monotonically increasing integer per connection (client-side sequence).
-`{device_id}` is the speaker's MAC address with colons removed (e.g. `08DF1F0BA325`).
+`{device_id}` is the speaker's MAC address with colons removed (e.g. `AABBCCDDEE0A`).
 
 ---
 

docs/content/docs/reference/FEATURE-MAPPING.md

@@ -84,7 +84,7 @@ Device system settings:
 $ soundtouch-cli --host 192.0.2.100 analyze
 
 🔍 Device Capability Analysis:
-  Device ID: 08DF1F0BA325
+  Device ID: AABBCCDDEE0A
   Feature Coverage: 87% (13/15 features)
   Device Type: Premium SoundTouch Speaker (Full Feature Set)