Add ESP32 recovery app with WiFi setup portal

- New flash layout (partitions.csv): factory = recovery app, ota_0/ota_1 =
  clock firmware; esp32_usb uploads to ota_0 so it never overwrites it
- src/recovery: WiFi + OTA + web page only. Opens the password protected
  'FlipDot-Setup' AP with a captive portal when WiFi fails, lets you pick
  another WiFi (stored in NVS, used by both apps), start the clock or stay
- Recovery is started when the clock firmware can't connect to WiFi,
  crashes 3 times, after 3 quick power cycles, from a new Home Assistant
  button, or by the bootloader when no clock firmware works
- Shared NVS store and boot switching in src/esp32/system
- Clock firmware keeps working on the old flash layout (falls back to
  OTA-only safe mode)
- README: recovery app, one-time USB installation; tests: 65 total

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/net/home_assistant.cpp

@@ -6,6 +6,7 @@
 
 #include "config.h"
 #include "credentials.h"
+#include "system/boot_target.h"
 
 static WiFiClient client;
 static HADevice device(HA_DEVICE_ID, sizeof(HA_DEVICE_ID));
@@ -15,6 +16,7 @@ static HAMqtt mqtt(client, device);
 static HASwitch clockSwitch("FlipDotDisplayClock");
 static HASwitch powerSwitch("FlipDotDisplayPower");
 static HASensor firmwareSensor("FlipDotDisplayFirmware");
+static HAButton recoveryButton("FlipDotDisplayRecovery");
 
 static char firmware_status[64] = "";
 static bool firmware_status_sent = false;
@@ -51,6 +53,10 @@ void homeAssistantBegin(DisplayController &controller)
 	powerSwitch.setCurrentState(controller.powerEnabled());
 	powerSwitch.onCommand(onPowerCommand);
 
+	recoveryButton.setName("FlipDot Display Recovery");
+	recoveryButton.setIcon("mdi:lifebuoy");
+	recoveryButton.onCommand([](HAButton *) { rebootToRecovery(RecoveryReason::Manual); });
+
 	firmwareSensor.setName("FlipDot Display Firmware");
 	firmwareSensor.setIcon("mdi:chip");
 	// The sensor doesn't resend its value on reconnect by itself