Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/logic/boot_policy.cpp

@@ -35,3 +35,36 @@ bool shouldClearCrashCount(uint32_t running_ms)
 {
 	return running_ms >= CRASH_FREE_TIME;
 }
+
+const char *recoveryReasonText(RecoveryReason reason)
+{
+	switch (reason)
+	{
+	case RecoveryReason::Wifi:
+		return "the clock firmware could not connect to WiFi";
+	case RecoveryReason::Crash:
+		return "the clock firmware crashed repeatedly";
+	case RecoveryReason::Manual:
+		return "requested from Home Assistant";
+	case RecoveryReason::PowerCycle:
+		return "the power was switched on and off quickly";
+	case RecoveryReason::None:
+	default:
+		return "no working clock firmware";
+	}
+}
+
+bool powerCyclesRequestRecovery(uint8_t power_on_count)
+{
+	return power_on_count >= POWER_CYCLES_FOR_RECOVERY;
+}
+
+bool recoveryShouldStartMain(RecoveryReason reason, uint32_t running_ms, bool wifi_connected,
+							 bool main_available)
+{
+	if (!main_available)
+		return false;
+	if (reason == RecoveryReason::Wifi)
+		return wifi_connected && running_ms >= RECOVERY_MIN_TIME;
+	return running_ms >= RECOVERY_TIME;
+}

src/esp32/logic/boot_policy.h

@@ -9,8 +9,12 @@
 //   Software reset           normal start (e.g. after an OTA update)
 //   Crash (panic, watchdog)  crash counter + 1, then:
 //                              < SAFE_MODE_CRASHES  OTA-only for OTA_PANIC_WINDOW, then normal
-//                              >= SAFE_MODE_CRASHES safe mode: OTA only for SAFE_MODE_TIME
+//                              >= SAFE_MODE_CRASHES safe mode: the recovery app, or OTA
+//                                                   only for SAFE_MODE_TIME without it
 //   Other (brownout, ...)    normal start, counter kept
+//
+// The recovery app (src/recovery) uses the same file to decide when to start the clock
+// firmware again.
 
 enum class ResetKind
 {
@@ -43,3 +47,26 @@ bool shouldMarkFirmwareValid(uint32_t running_ms, bool wifi_connected);
 
 // Running this long without a crash clears the crash counter
 bool shouldClearCrashCount(uint32_t running_ms);
+
+// Why the recovery app was started (stored in NVS, shared by both apps)
+enum class RecoveryReason : uint8_t
+{
+	None = 0,       // no firmware in ota_0/ota_1, or the bootloader fell back to recovery
+	Wifi = 1,       // the clock firmware couldn't connect to WiFi
+	Crash = 2,      // the clock firmware crashed SAFE_MODE_CRASHES times in a row
+	Manual = 3,     // Home Assistant button
+	PowerCycle = 4, // switched on POWER_CYCLES_FOR_RECOVERY times quickly
+};
+
+const char *recoveryReasonText(RecoveryReason reason);
+
+// Power-on count: each power on within POWER_CYCLE_WINDOW of the previous one counts.
+// True when the next start should be the recovery app.
+bool powerCyclesRequestRecovery(uint8_t power_on_count);
+
+// Recovery app: time to start the clock firmware again?
+//   Wifi reason:   as soon as WiFi is connected again (but not before RECOVERY_MIN_TIME)
+//   other reasons: after RECOVERY_TIME (so a manual visit has time for an OTA upload)
+//   never when there is no clock firmware
+bool recoveryShouldStartMain(RecoveryReason reason, uint32_t running_ms, bool wifi_connected,
+							 bool main_available);