ESP32-S3 摄像头图传：固件 + Slint 客户端 + 共享协议

两块 ESP32-S3-WROOM-1-N16R8 图传板（DVP 接口接 OV2640/OV3660/OV5640），
向队伍客户端与裁判终端推 UDP 图传。固件是跑在 ESP-IDF 上的 Rust，用官方
esp32-camera 组件采集；客户端是 Rust + Slint 桌面程序。

三个 crate 各自独立构建：
  .            firmware，交叉编译到 Xtensa
  protocol/    线路格式与帧重组，两端共用，无 ESP-IDF 依赖，有单元测试
  client/      Slint 桌面客户端

视频走 UDP 而非 TCP：实测传感器产出 22 fps，TCP MJPEG 只送出 1.9 fps，
且只占用链路能力的 1%——链路是空的，帧堵在队头阻塞后面等一个实时画面
等不起的重传计时器。改为独立数据报、不重传、缺片丢整帧后达到 20.8 fps。

发现是双向的：板子每 2 秒广播 Hello，客户端广播 Subscribe，板子据此定向
推流。板子身份由 MAC 派生，重启不变，所以客户端可以把绑定存进配置。

裁判端同时收两块板子（每个发送方一个重组器），队伍端绑定其中一块并只显示
自己那一边的血量。装甲板接口已预留（ArmorSource trait + ARMOR_PORT），
当前无数据源，界面显示占位符。

vendor 了 esp32-camera 2.1.7：组件注册表的版本求解器找不到它，且需要打一处
补丁（见 components/esp32-camera/target/esp32s3/ll_cam.c）。

.gitignore 三条 target/ 都锚定在根目录，因为 protocol/ 与 client/ 各自也是
独立 crate；而 components/esp32-camera/target/ 是上游的按芯片分目录，里面是
源码，必须保留。

scripts/flash.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Builds, picks a flash offset that avoids the module's defective byte, flashes,
+# and prints the serial log.
+#
+# The module this was developed against has one byte in its SPI flash at
+# 0xFADE7 whose bits 5..7 cannot be programmed (see README). Whatever value the
+# app image places there gets corrupted, the image checksum fails, and the
+# bootloader refuses to boot it. The image itself is unaffected by where it is
+# placed in flash, so moving the app partition is enough: this picks the lowest
+# 64 KB-aligned offset whose byte at that address the flash can actually store.
+#
+# Usage: scripts/flash.sh [--monitor SECONDS]
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+readonly BAD_FLASH_ADDR="${BAD_FLASH_ADDR:-0xFADE7}"
+readonly ALIGN="${ALIGN:-0x10000}"
+readonly MAX_APP_SIZE="${MAX_APP_SIZE:-0x120000}"
+
+MONITOR_SECS=25
+if [ "${1:-}" = "--monitor" ]; then
+    MONITOR_SECS="${2:-25}"
+fi
+
+port="${ESP_PORT:-}"
+if [ -z "$port" ]; then
+    port=$(ls /dev/cu.usbmodem* /dev/cu.wchusbserial* /dev/cu.SLAB* /dev/cu.usbserial* 2>/dev/null | head -1 || true)
+fi
+if [ -z "$port" ]; then
+    echo "no serial port found; set ESP_PORT=/dev/cu.xxx" >&2
+    exit 1
+fi
+
+out=$(ls -d target/xtensa-esp32s3-espidf/release/build/esp-idf-sys-*/out/build 2>/dev/null | head -1 || true)
+
+echo "==> build"
+./scripts/build.sh
+
+echo "==> pick app offset"
+espflash save-image --chip esp32s3 --format esp-idf \
+    target/xtensa-esp32s3-espidf/release/esp32 /tmp/esp32-cam-app.bin >/dev/null
+
+read -r offset < <(python3 - <<PY
+import sys
+data = open("/tmp/esp32-cam-app.bin", "rb").read()
+bad = $BAD_FLASH_ADDR
+align = $ALIGN
+flash_size = 16 * 1024 * 1024
+for off in range(align, flash_size - len(data), align):
+    at = bad - off
+    if at < 0 or at >= len(data):
+        continue
+    if data[at] & 0xE0 == 0:          # top three bits must be storable
+        print(off)
+        break
+else:
+    sys.exit("no usable app offset found; this module's flash is too broken")
+PY
+)
+
+printf '0x%x\n' "$offset"
+
+# Write the chosen offset into partitions.csv.
+python3 - "$offset" <<'PY'
+import re, sys
+offset = int(sys.argv[1], 0)
+p = "partitions.csv"
+s = open(p).read()
+s2 = re.sub(r"^(factory,\s+app,\s+factory,\s+)0x[0-9a-fA-F]+",
+            lambda m: m.group(1) + "0x%06x" % offset, s, flags=re.M)
+if s2 != s:
+    open(p, "w").write(s2)
+    print("partitions.csv updated")
+else:
+    print("partitions.csv already at 0x%06x" % offset)
+PY
+
+echo "==> reconfigure + rebuild with the new table"
+rm -rf target/xtensa-esp32s3-espidf/release/build/esp-idf-sys-*
+./scripts/build.sh
+
+espflash save-image --chip esp32s3 --format esp-idf \
+    target/xtensa-esp32s3-espidf/release/esp32 /tmp/esp32-cam-app.bin >/dev/null
+
+out=$(ls -d target/xtensa-esp32s3-espidf/release/build/esp-idf-sys-*/out/build | head -1)
+
+# The rebuild can shift the image, so confirm before committing to the flash.
+python3 - <<PY || { echo "image moved onto the bad byte again; rerun" >&2; exit 1; }
+import sys
+data = open("/tmp/esp32-cam-app.bin", "rb").read()
+at = $BAD_FLASH_ADDR - $offset
+if not (0 <= at < len(data)) or data[at] & 0xE0:
+    print("byte at 0x%X is 0x%02X, not storable" % ($BAD_FLASH_ADDR, data[at] if 0 <= at < len(data) else -1))
+    sys.exit(1)
+print("byte at 0x%X is 0x%02X, storable" % ($BAD_FLASH_ADDR, data[at]))
+PY
+
+echo "==> flash $port"
+esptool_py=$(ls "$HOME"/.espressif/tools/python/*/venv/bin/python 2>/dev/null | head -1)
+"$esptool_py" -m esptool --chip esp32s3 --port "$port" --baud 460800 write-flash \
+    0x0 "$out/bootloader/bootloader.bin" \
+    0x8000 "$out/partition_table/partition-table.bin" \
+    "$offset" /tmp/esp32-cam-app.bin 2>&1 | grep -viE 'writing at|^\[1A' | tail -4
+
+if [ "$MONITOR_SECS" -gt 0 ]; then
+    echo "==> serial log (${MONITOR_SECS}s)"
+    python3 - "$port" "$MONITOR_SECS" <<'PY'
+import os, sys, termios, time
+fd = os.open(sys.argv[1], os.O_RDONLY | os.O_NOCTTY)
+a = termios.tcgetattr(fd)
+a[0] = a[1] = a[3] = 0
+a[2] = termios.CS8 | termios.CREAD | termios.CLOCAL
+a[4] = a[5] = termios.B115200
+a[6][termios.VMIN] = 0
+a[6][termios.VTIME] = 1
+termios.tcsetattr(fd, termios.TCSANOW, a)
+end = time.time() + float(sys.argv[2])
+while time.time() < end:
+    try:
+        d = os.read(fd, 4096)
+    except OSError:
+        break
+    if d:
+        sys.stdout.write(d.decode("utf-8", "replace"))
+        sys.stdout.flush()
+PY
+fi