[BUG] WpaPsk connect fails on SAE-only WPA3-Personal APs

[cachebag]

Describe the bug

WifiSecurity::WpaPsk is documented as WPA/WPA2/WPA3 Personal, and nmrs correctly decodes SAE-only access points as ConnectType::Sae via AccessPoint::security.preferred_connect_type().

However, connecting to an SAE-only/WPA3-Personal AP with the high-level API still builds a profile with PSK key management:

nm.connect(
    ssid,
    Some("wlan0"),
    WifiSecurity::WpaPsk { psk },
).await?;

That path reaches WifiConnectionBuilder::wpa_psk, which writes:

802-11-wireless-security.key-mgmt = "wpa-psk"

NetworkManager rejects that on SAE-only APs before authentication:

org.freedesktop.NetworkManager.Settings.Connection.InvalidProperty: 802-11-wireless-security.key-mgmt: Access point does not support PSK but setting requires it

This came up while replacing the COSMIC Settings networking backend with nmrs = "3.4.0". After forgetting a saved SAE network, selecting the AP and entering the correct password repeatedly prompted again because each retry created the same wpa-psk profile and NetworkManager rejected it.

What should happen?:

nmrs should support WPA3-Personal/SAE connects without callers manually patching raw settings.

Possible fixes:

• Add an explicit WifiSecurity::Sae { psk } variant and WifiConnectionBuilder::sae(...) that emits key-mgmt=sae.
• Or make the high-level NetworkManager::connect path AP-aware: when the target AP's preferred connect type is ConnectType::Sae, emit key-mgmt=sae instead of wpa-psk.
• If WifiSecurity::WpaPsk is not intended to cover SAE-only APs, adjust docs that currently describe it as WPA/WPA2/WPA3 Personal.

Additional context

Relevant nmrs 3.4.0 code paths:

• SecurityFeatures::preferred_connect_type() can return ConnectType::Sae.
• WifiConnectionBuilder::wpa_psk always inserts key-mgmt=wpa-psk.
• build_wifi_connection maps WifiSecurity::WpaPsk to .wpa_psk(...).

Temporary workaround used downstream in COSMIC Settings:

1. Preserve the AP's ConnectType::Sae through the UI password flow.
2. Build normal Wi-Fi settings with WifiConnectionBuilder::new(ssid).wpa_psk(password).
3. Mutate the security section to key-mgmt=sae and remove auth-alg.
4. Call add_and_activate_connection with the visible AP path.

[cachebag]

Ref: pop-os/cosmic-settings#2068