Fix tube flicker and review fixes

- The bit-banged WS2812 update disables interrupts (about 30 us per
  pixel), which made the lit tube stay on longer and flash. neoShow()
  now only sends when the pixels changed (fixed colour was resent every
  second) and waits for the dark gap between tubes; the bit-bang strip
  has no headroom pixels. This also fixed digits that seemed to hang.
- 4 WS2812 on this board, one per tube (not 8)
- Saving the firmware URL in the web UI no longer starts an HTTP
  update; never update from an empty URL
- Restart once after the first switch from AP mode to WiFi, so
  ArduinoOTA and MQTT start on the real network
- Optional web UI password (WEB_USER/WEB_PASSWORD in secrets.h);
  /getConfiguration returns the stored WiFi and MQTT passwords
- Cathode protect: random mode now starts at a random tube (the +-1
  start digits were swapped and then overwritten)
- Apply the unused gamma table to wheel colours
- LOOP_DIAG (off by default): main-loop stalls in /getCurrentInfos,
  which now also reports uptime and free heap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -1,6 +1,6 @@
 # Nixie clock: notes for Claude
 
-An AliExpress WiFi nixie clock (4x IN-12 + 2x IN-3 neon dots, 8x WS2812) that is being
+An AliExpress WiFi nixie clock (4x IN-12 + 2x IN-3 neon dots, 4x WS2812, one under each tube) that is being
 moved from its closed stock firmware to ESP_UniClock (https://github.com/gpeter62/ESP_UniClock)
 with ArduinoOTA and Home Assistant (MQTT) support.
 
@@ -42,7 +42,7 @@ on the clock with UniClock; "Binary" = only confirmed in the stock SV1.3 code.
 |---|---|---|
 | 74HC595 DATA / CLOCK (OE tied to GND) | 13 / 14 = HSPI MOSI / SCK (hardware SPI, MSB first) | Hardware |
 | 74HC595 LATCH | 15, plain `digitalWrite` (has 1k pull-down) | Hardware |
-| WS2812 data | 12 (NeoPixel bit-bang, GRB 800 kHz; 8 fitted, stock assumes 12). `SPI.begin()` turns GPIO12 into MISO: set it back to OUTPUT afterwards | Hardware |
+| WS2812 data | 12 (NeoPixel bit-bang, GRB 800 kHz; 4 fitted, stock assumes 12). `SPI.begin()` turns GPIO12 into MISO: set it back to OUTPUT afterwards | Hardware |
 | Photoresistor (LDR, 10k to GND) | ADC (A0) | Hardware |
 | BTN1 / BTN2 (not fitted) | 0 / 2, INPUT_PULLUP. Stock: GPIO0 is a button, GPIO2 a motion/presence input that wakes the display | Binary |
 | DFPlayer Mini (stock feature) | UART0: GPIO1 TX / GPIO3 RX, 9600 Bd | Binary |
@@ -70,9 +70,11 @@ GPIO0 to GND, tap RST to GND, then release GPIO0.
 - esptool is installed for the user (`python -m esptool`, v5.6.0). After `--after no-reset`
   the stub keeps running at the new baud rate and the next esptool call can't connect: do
   everything in one call, or re-enter flash mode.
-- Normal updates go over WiFi: `pio run -e nixie_in12_ota -t upload` in `firmware/uniclock/`.
-  ArduinoOTA does not answer after the clock switched from AP mode to WiFi without a reboot
-  (first setup); a power cycle fixes it.
+- Normal updates go over WiFi: `pio run -e nixie_in12_ota -t upload` in `firmware/uniclock/`
+  (web UI files: `-t uploadfs`). After the first switch from AP mode to WiFi the clock restarts
+  once by itself, so ArduinoOTA/MQTT start on the real network.
+- `/getCurrentInfos` (no password) has `uptime` and `heap`; with `LOOP_DIAG` in CLOCK_90 also
+  `stalls` (main-loop gaps of 250 ms or more, by step name).
 - `firmware/stock/` holds the stock flash dump. **Never overwrite or delete it**; it is the
   only way back to SV1.3 (`write-flash 0 <dump>`). Dumps are gitignored because the flash
   holds the WiFi password; never commit them.
@@ -94,4 +96,8 @@ GPIO0 to GND, tap RST to GND, then release GPIO0.
    `mqtt.ino` rewritten for ArduinoHA 2.1.0: switches Tubes/Auto dim, numbers Day/Night
    brightness, light Backlight (on/off, brightness, RGB -> UniClock colour wheel), select LED
    effect, button Cathode protect, sensors Light/WiFi signal. Broker settings are read at boot.
-5. Open: OTA password via `secrets.h`; ArduinoOTA after the AP -> WiFi switch.
+5. Done (2026-10-25): tube flicker fixed (the bit-banged WS2812 update blocks interrupts, so
+   it is now only sent when the pixels change, and only in the dark gap between tubes; this also
+   fixed digits that seemed to hang). Saving the firmware URL no longer starts an update.
+   Optional web password, cathode-protect random start, LED gamma.
+6. Open: the user can create `secrets.h` (gitignored, never read it) for OTA and web passwords.