Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/config.h

@@ -74,6 +74,16 @@ const uint32_t FIRMWARE_VALID_TIME = 60UL * 1000;
 const uint32_t CRASH_FREE_TIME = 5UL * 60 * 1000;
 // loop() must not block longer than this, or the ESP32 restarts (counts as a crash)
 const uint32_t WATCHDOG_TIMEOUT_S = 30;
+// Recovery app (src/recovery): started by the triggers in logic/boot_policy.h
+const uint8_t POWER_CYCLES_FOR_RECOVERY = 3;  // power ons in a row ...
+const uint32_t POWER_CYCLE_WINDOW = 10000;    // ... each switched off within this time
+const uint32_t RECOVERY_TIME = 10UL * 60 * 1000; // then back to the clock firmware
+// Stay at least this long, also when the WiFi works right away (limits switching back and
+// forth, which wears the otadata flash sector)
+const uint32_t RECOVERY_MIN_TIME = 60UL * 1000;
+#define SETUP_AP_SSID "FlipDot-Setup"          // password: SETUP_AP_PASSWORD in secrets.h
+const uint32_t SETUP_AP_DELAY = 20000;        // open the AP when WiFi fails this long
+
 // WiFi: first connection at boot, and restart when WiFi stays down this long
 const uint32_t WIFI_CONNECT_TIMEOUT = 30000;
 const uint32_t WIFI_RESTART_TIME = 10UL * 60 * 1000;