ESP32-S3 摄像头图传：固件 + Slint 客户端 + 共享协议

两块 ESP32-S3-WROOM-1-N16R8 图传板（DVP 接口接 OV2640/OV3660/OV5640），
向队伍客户端与裁判终端推 UDP 图传。固件是跑在 ESP-IDF 上的 Rust，用官方
esp32-camera 组件采集；客户端是 Rust + Slint 桌面程序。

三个 crate 各自独立构建：
  .            firmware，交叉编译到 Xtensa
  protocol/    线路格式与帧重组，两端共用，无 ESP-IDF 依赖，有单元测试
  client/      Slint 桌面客户端

视频走 UDP 而非 TCP：实测传感器产出 22 fps，TCP MJPEG 只送出 1.9 fps，
且只占用链路能力的 1%——链路是空的，帧堵在队头阻塞后面等一个实时画面
等不起的重传计时器。改为独立数据报、不重传、缺片丢整帧后达到 20.8 fps。

发现是双向的：板子每 2 秒广播 Hello，客户端广播 Subscribe，板子据此定向
推流。板子身份由 MAC 派生，重启不变，所以客户端可以把绑定存进配置。

裁判端同时收两块板子（每个发送方一个重组器），队伍端绑定其中一块并只显示
自己那一边的血量。装甲板接口已预留（ArmorSource trait + ARMOR_PORT），
当前无数据源，界面显示占位符。

vendor 了 esp32-camera 2.1.7：组件注册表的版本求解器找不到它，且需要打一处
补丁（见 components/esp32-camera/target/esp32s3/ll_cam.c）。

.gitignore 三条 target/ 都锚定在根目录，因为 protocol/ 与 client/ 各自也是
独立 crate；而 components/esp32-camera/target/ 是上游的按芯片分目录，里面是
源码，必须保留。

scripts/pick-flash-pad.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Finds a FLASH_PAD value that moves the firmware off a defective SPI flash byte.
+#
+# The module this was developed against has one byte at flash address 0xFADE7
+# whose bits 5..7 cannot be programmed, so whatever lands there gets corrupted
+# and the image checksum (and therefore the app) fails to boot. Growing
+# FLASH_PAD shifts .flash.text, which moves a different byte onto that address.
+# A byte is safe when its top three bits are zero, i.e. value <= 0x1F.
+#
+# Usage: scripts/pick-flash-pad.sh [max_attempts]
+# Prints the FLASH_PAD value to use, or exits non-zero if none was found.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+# Flash address of the defective cell, and the offset of the app partition.
+readonly BAD_FLASH_ADDR="${BAD_FLASH_ADDR:-0xFADE7}"
+readonly APP_OFFSET="${APP_OFFSET:-0x10000}"
+readonly MAX_ATTEMPTS="${1:-40}"
+
+image=$(mktemp -t esp32-app.XXXXXX.bin)
+trap 'rm -f "$image"' EXIT
+
+bad_offset=$(python3 -c "print($BAD_FLASH_ADDR - $APP_OFFSET)")
+
+echo "bad cell: flash $BAD_FLASH_ADDR (image offset $bad_offset)"
+
+for ((pad = 0; pad < MAX_ATTEMPTS; pad++)); do
+    FLASH_PAD="$pad" ./scripts/build.sh >/dev/null 2>&1 || {
+        echo "build failed for FLASH_PAD=$pad" >&2
+        exit 1
+    }
+
+    espflash save-image --chip esp32s3 --format esp-idf \
+        target/xtensa-esp32s3-espidf/release/esp32 "$image" >/dev/null 2>&1
+
+    byte=$(python3 - "$image" "$bad_offset" <<'PY'
+import sys
+data = open(sys.argv[1], "rb").read()
+off = int(sys.argv[2])
+print(data[off] if off < len(data) else -1)
+PY
+)
+
+    if (( byte >= 0 && (byte & 0xE0) == 0 )); then
+        echo "FLASH_PAD=$pad works: byte at $BAD_FLASH_ADDR would be 0x$(printf '%02X' "$byte")"
+        echo "set FLASH_PAD to $pad (in src/main.rs, or export it at build time)"
+        exit 0
+    fi
+
+    echo "  FLASH_PAD=$pad -> 0x$(printf '%02X' "$byte" 2>/dev/null || echo '??') (unsafe)"
+done
+
+echo "no safe FLASH_PAD found in 0..$((MAX_ATTEMPTS - 1)); this module's flash is too broken" >&2
+exit 1