scripts: 修 udp_probe.py 的重组与 fps 两处测量错误

探测脚本是诊断工具，测错比不测更糟——它给出的数字会被当成结论。

**重组状态必须按 (sender_id, frame_id) 存。** 原先只按 sender_id 存，于是丢片
之后下一帧的分片会接着凑上一帧的计数，凑够了交出去一张混着两帧的 JPEG，表现为
"JPEG 不完整"。修完：14 秒 132 帧，0 张坏帧。

换帧时被放弃的半成品单独计为"被新帧取代"，不并入"JPEG 不完整"——它们本来就
不完整，混在一起会把两种情形都算成链路有问题。

**分窗 fps 的分子分母必须同量纲。** 原先用累计帧数除以窗口时长，于是报出 39、
61、79 这种随时间单调上升的假数字，看起来像板子越跑越快。改成窗口增量除以窗
口时长后稳定在 22，也就是传感器上限。

顺带修正两处与代码不符的注释：

  partitions.csv / sdkconfig.defaults
    两处都写死 app 分区在 0x40000，实际是 scripts/flash.sh 自动挑选并写回，
    当前为 0x060000。补上 flash.sh 会重编译并复验的原因（重编译会让镜像位移，
    所以偏移无法是常量）。

  .env.example
    补 CAM_VSYNC_INVERT 和 WIFI_AUTH。WIFI_AUTH 一直能用但没进文档：通常不用
    设，扫描会报告 AP 的真实认证方式；只有扫不到时（隐藏 SSID）才需要指定，
    指定后只试这一种，不成功直接报错而不是挨个试 10 秒——挨个试等于在猜一个
    本该已知的值。

partitions.csv

@@ -1,14 +1,17 @@
 # Name,     Type, SubType,  Offset,   Size,     Flags
 #
-# The app partition starts at 0x40000 rather than the usual 0x10000 on purpose:
-# the module this firmware was first brought up on has a defective byte in its
-# SPI flash at 0xFADE7 (bits 5..7 cannot be programmed). The app image is
-# unchanged by where it is placed, so moving the partition moves which image byte
-# lands on that address - and at 0x40000 the byte there is 0x1A, which the flash
-# accepts.
+# The app partition offset here is chosen by scripts/flash.sh, not by hand. It
+# sits well above the usual 0x10000 because the module this firmware was first
+# brought up on has a defective byte in its SPI flash at 0xFADE7 (bits 5..7
+# cannot be programmed). The app image is unchanged by where it is placed, so
+# moving the partition moves which image byte lands on that address - and
+# because a rebuild can shift the image again, re-deriving the offset by hand
+# would break on the next build. flash.sh picks the lowest 64 KB-aligned offset
+# whose byte at that address the flash can actually store, writes it back here,
+# and rebuilds.
 #
-# If you move to healthy hardware, put `factory` back at 0x10000 and delete the
-# note in sdkconfig.defaults; nothing else depends on this.
+# If you move to healthy hardware, put `factory` back at 0x10000 and delete
+# BAD_FLASH_ADDR from scripts/flash.sh; nothing else depends on this.
 nvs,        data, nvs,      0x9000,   0x6000,
 phy_init,   data, phy,      0xf000,   0x1000,
 factory,    app,  factory,  0x060000,  0x120000,