feat: USB companion firmware flasher (dashboard + esptool)

[iceice400]

Summary

• Adds USB companion firmware flashing from Settings → System — upload .bin, confirm via DangerousModal, run esptool with live log stream on authenticated WebSocket
• MeshCore USB capture releases serial before flash; existing auto-reconnect restores the companion after reboot
• No radio TX — subprocess + WS only

Part of Master PR Roadmap #14 (FR3 Field Operations). PRs 15–16 (remote ADMIN config) follow after merge.

Risks / notes

• Wrong serial port selected → esptool timeout, no write (chip identity check first)
• MeshCore may show disconnected until reconnect loop picks up the port (~5–15 s)
• Large uploads capped at 10 MB; held in temp file until flash completes
• Partition offset default 0x10000 — verify for your board firmware layout

Test plan

• python -m unittest tests.test_firmware_flasher -v (6 tests, pass)
• Flash real .bin on RAK7248 + Heltec MeshCore companion
• Verify 409 when second flash starts on same port
• Verify unauthenticated WS closes with 4401
• Verify audit log entry firmware_flash with duration and exit code

AI-assisted

PR description and implementation assisted by Claude. Code reviewed against Meshpoint patterns (DangerousModal, timed_action, _gate_ws_or_close).

[Cryptocurrency4Sale]

Sweet! Can't wait for this one! No more climbing on the roof to upgrade the firmware on a USB MeshCore companion.