[RFC] Add flash-complete integrity flag and startup bootloader timeout

[benjamin-nomadic]

Motivation:

In CAN-only systems with no physical reset button, two failure modes exist:

1. An interrupted flash session leaves corrupt firmware that application_check_valid() accepts (reset vector was written in the first block)
2. If the running firmware is broken it cannot send REQUEST_CANBOOT, making the device unrecoverable without physical access

Feature 1: Flash-complete integrity flag

Reserves the last 2KB flash page as a completion marker:

Page erased (0xFFFFFFFF) = flash incomplete → stay in bootloader indefinitely
First word 0x00000001 = flash complete → normal boot
command_write_block (first call) erases the flag page. command_eof writes the magic. bootentry_check() treats an absent flag identically to !application_check_valid().

Files: src/stm32/flash.c, src/stm32/flash.h, src/flashcmd.c, src/bootentry.c

Flash layout (STM32G431CB, as implemented)

0x08000000 Katapult bootloader (8KB)
0x08002000 Application firmware (110KB, reduced from 112KB)
0x0801D800 Flash complete flag (2KB reserved page) ← new
0x0801E000 Application config (8KB, unchanged)
0x08020000 End of flash

Feature 2: Startup bootloader timeout

On normal boot with a valid app and no explicit request, the bootloader stays active for 5 seconds before jumping to the application. The timer resets while flashcmd_is_in_transfer() is true so it never fires mid-upload. Explicit bootloader requests (RAM magic, no valid app, button) are unaffected — bootloader stays indefinitely as before.

Files: src/bootentry.c

What needs rework before merging

FLASH_FLAG_ADDRESS hardcoded for STM32G431CB — needs derivation from Kconfig + page size
Flash flag only implemented for STM32 — RP2040/LPC176x equivalents needed
Timeout and flag should be opt-in Kconfig options with configurable duration

Comments and help on properly integrating the changes into katapult would be greatly appreciated! Katapult itself worked great, thank you for your work.