Stabilize concurrent SSH and WebSocket transports

sdkconfig.defaults

@@ -17,6 +17,11 @@ CONFIG_LWIP_TCP_OOSEQ_MAX_PBUFS=4
 # Active TLS material remains unencrypted in PSRAM until the hardening phase.
 CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
 # CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
+# Hardware AES can hang in the PSRAM DMA path and cannot be shared safely with
+# wolfSSL's independently locked ESP32 acceleration. Software AES is fast enough
+# at 240 MHz for bounded serial traffic and leaves ESP-IDF's SHA/MPI paths intact.
+# CONFIG_MBEDTLS_HARDWARE_AES is not set
+# CONFIG_MBEDTLS_AES_USE_INTERRUPT is not set
 # HTTPS remains on ESP-IDF's mbedTLS backend; wolfSSL is linked only for wolfSSH.
 CONFIG_ESP_TLS_USING_MBEDTLS=y
 
@@ -40,6 +45,7 @@ CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192
 
 # Build wolfSSH and wolfCrypt without replacing the HTTPS TLS implementation.
 CONFIG_ESP_ENABLE_WOLFSSH=y
+
 # The managed component emits a generic RSA stack warning although this target disables RSA.
 CONFIG_ESP_WOLFSSL_NO_STACK_SIZE_BUILD_WARNING=y