Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -104,7 +104,24 @@ See README.md for the overview.
 - The crash counter lives in `RTC_NOINIT_ATTR` memory. Decisions are in
   `logic/boot_policy.*` (tested). Safe mode runs only WiFi + OTA.
 - Keep `otaLoop()` and `firmwareGuardLoop()` at the top of `loop()`, before anything that
-  can return early or block.
+  can return early or block. Keep `firmwareGuardBegin()` first in `setup()`: it holds
+  the power-cycle trigger for the recovery app.
+- Flash layout `partitions.csv`: factory = recovery app (`src/recovery`, env `recovery`,
+  USB only), ota_0/ota_1 = clock firmware. `esp32_usb` uploads to 0x110000
+  (`board_upload.offset_address`) so it never overwrites the recovery app. Check with
+  `pio run -e <env> -t envdump` (`ESP32_APP_OFFSET`) after changing upload settings.
+- The recovery app compiles `esp32/logic/boot_policy.cpp`, `esp32/system/system_store.cpp`
+  and `esp32/system/boot_target.cpp` (see its `build_src_filter`). Keep those free of
+  clock-firmware dependencies. Both apps share NVS namespace `flipdot`. RTC memory is
+  not shared between the apps (different layouts).
+- `rebootToRecovery()` selects the factory partition, which erases otadata. The recovery
+  app later selects the clock slot again (`startMainFirmware()`), so the clock firmware
+  is `PENDING_VERIFY` again and must pass the 60 s check, or the bootloader falls back to
+  the recovery app.
+- The clock firmware still works on the old flash layout (no factory partition):
+  `rebootToRecovery()` returns, and the callers fall back to OTA-only mode or a restart.
+- Arduino's `esp_app_desc_t` version and date come from the precompiled core, so the
+  clock firmware stores `FIRMWARE_VERSION` per slot in NVS for the recovery page.
 
 ## Git