Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/logic/boot_policy.cpp

@@ -35,3 +35,36 @@ bool shouldClearCrashCount(uint32_t running_ms)
 {
 	return running_ms >= CRASH_FREE_TIME;
 }
+
+const char *recoveryReasonText(RecoveryReason reason)
+{
+	switch (reason)
+	{
+	case RecoveryReason::Wifi:
+		return "the clock firmware could not connect to WiFi";
+	case RecoveryReason::Crash:
+		return "the clock firmware crashed repeatedly";
+	case RecoveryReason::Manual:
+		return "requested from Home Assistant";
+	case RecoveryReason::PowerCycle:
+		return "the power was switched on and off quickly";
+	case RecoveryReason::None:
+	default:
+		return "no working clock firmware";
+	}
+}
+
+bool powerCyclesRequestRecovery(uint8_t power_on_count)
+{
+	return power_on_count >= POWER_CYCLES_FOR_RECOVERY;
+}
+
+bool recoveryShouldStartMain(RecoveryReason reason, uint32_t running_ms, bool wifi_connected,
+							 bool main_available)
+{
+	if (!main_available)
+		return false;
+	if (reason == RecoveryReason::Wifi)
+		return wifi_connected && running_ms >= RECOVERY_MIN_TIME;
+	return running_ms >= RECOVERY_TIME;
+}