cosmic-applet-network fails to connect to WPA3-SAE-only networks (falls back to key-mgmt=wpa-psk)

[waybarrios]

Description

When connecting to a Wi-Fi network that advertises WPA3-SAE only (no WPA2/PSK fallback) from the network applet in the top panel, entering the correct password never succeeds. The connection is rejected immediately, before any password/handshake validation, because NetworkManager is asked to create the connection with key-mgmt=wpa-psk instead of key-mgmt=sae.

A 2.4GHz SSID broadcasting mixed WPA2/WPA3 on the same router connects without any problem using the same applet. Windows (dual-boot, same hardware) connects to the WPA3-SAE-only SSIDs without issue, which rules out a driver/firmware/hardware problem.

This looks like a follow-on to #1590 (cosmic-settings) — once WPA3-only networks started appearing in the list, the connect flow itself still doesn't request the right security type.

Environment

OS: Pop!_OS (kernel 7.0.11-76070011-generic)
cosmic-applets: 1.0.15~1784300395~24.04~48c3633
cosmic-settings: 1.0.12~1784654152~24.04~c262496
NetworkManager: 1.46.0-1ubuntu2.7
Wi-Fi adapter: Intel Alder Lake-P CNVi (Rivet Networks/Killer Wi-Fi 6E AX1690i, "Garfield Peak"), driver iwlwifi

Steps to Reproduce

1. Have an AP broadcast an SSID as WPA3-Personal (SAE) only, with no WPA2/PSK compatibility mode (e.g. a _6G/6GHz-band SSID, or an MLO SSID with no legacy fallback).
2. Click the network icon in the COSMIC panel, select that SSID from the list.
3. Enter the correct password in the applet's password prompt and confirm.

Expected behavior

The applet detects from the scanned AP capabilities that the network is SAE-only and creates/activates the NetworkManager connection with 802-11-wireless-security.key-mgmt=sae. Connection succeeds with the correct password.

Actual behavior

The connection attempt fails immediately (before the password is even checked), and retrying with the same correct password fails identically every time. journalctl -u NetworkManager shows:

NetworkManager[1079]: <info> audit: op="connection-add-activate" pid=3220 uid=1000 result="fail" reason="802-11-wireless-security.key-mgmt: Access point does not support PSK but setting requires it"

This repeats for every attempt from the applet. nmcli scan confirms the target SSIDs are SAE-only (no WPA2 in the security column), while the SSID on the same router that does connect fine is WPA2/WPA3 mixed:

SSID       CHAN  FREQ      SECURITY
<SSID>_MLO 40    5200 MHz  WPA3        <- fails from applet
<SSID>_MLO 5     2432 MHz  WPA3        <- fails from applet
<SSID>_6G  53    6215 MHz  WPA3        <- fails from applet
<SSID>     5     2432 MHz  WPA2 WPA3   <- connects fine from applet
<SSID>     40    5200 MHz  WPA2 WPA3   <- connects fine from applet

Workaround

Bypassing the applet and creating the connection directly with nmcli, letting nmcli auto-detect the security type from the scan cache, connects successfully on the first try with the same password:

nmcli device wifi connect "<SSID>_6G" password "<correct password>" ifname wlo1

This confirms the AP, driver, firmware, and NetworkManager itself all handle SAE correctly — the bug is isolated to how cosmic-applet-network builds the connection request.