Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/main.cpp

@@ -13,6 +13,7 @@
 #include "nano_link/nano_link.h"
 #include "net/home_assistant.h"
 #include "net/wifi_ota.h"
+#include "system/boot_target.h"
 #include "system/firmware_guard.h"
 
 NanoLink nano(Serial2, NANO_RX_PIN, NANO_TX_PIN, RELAY_PIN, NANO_RESET_PIN);
@@ -41,9 +42,11 @@ void setup()
 
 	if (boot_mode == BootMode::SafeMode)
 	{
-		// Crashed too often: only WiFi and OTA, then try the main code once more
-		otaOnlyMode(SAFE_MODE_TIME, LED_PIN);
+		// Crashed too often: the recovery app, or without it only WiFi and OTA here,
+		// then try the main code once more
 		firmwareGuardSafeModeEnded();
+		rebootToRecovery(RecoveryReason::Crash);
+		otaOnlyMode(SAFE_MODE_TIME, LED_PIN);
 		ESP.restart();
 	}
 	if (boot_mode == BootMode::PanicWindow)