Wi-Fi data path FIXED: esp_hosted 2.12 on both chips + C6 SDIO auto-OTA

Root cause of the dead data path (assoc/scan/RPC fine, zero data
frames): esp-hosted 1.4.x is formally incompatible with IDF 5.5
(esp-hosted-mcu#47) and the factory C6 slave firmware was ancient
(couldn't even answer a version RPC). Waveshare's examples pin 1.4.* —
do not follow them.

Fix:
- host: espressif/esp_hosted ^2.12 (+ esp_wifi_remote 1.6)
- slave: 2.12.11 network_adapter.bin embedded in the app (c6_ota.c
  streams it to the C6 over the SDIO RPC channel at boot when the
  reported version is < 2.x; ~10s, no wires, idempotent)
- RAM diet for hosted 2.x's footprint (MEMPOOL_PREFER_SPIRAM,
  reduced WIFI_RMT buffers) — without it internal SRAM famine
  boot-loops in xTaskCreateStaticPinnedToCore before app_main
- conservative 20MHz SDIO clock for first verified data path

Verified on hardware: DHCP lease (even that healed), 8/8 pings to
router and tower-of-joy at 1-5ms, WebSocket to the gateway connected,
device registered at /devices as desklock-p4 with fw version.

Also: wifi_diag.c L1 SoftAP diagnostic mode (DESKLOCK-DIAG) with
review fixes, boot ping ladder in net.c, static-IP fallback,
face_status() line, docs for the whole failure taxonomy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

firmware/main/face.c

@@ -450,6 +450,14 @@ face_state_t face_get(void)
     return F.state;
 }
 
+void face_status(const char *text)
+{
+    bsp_display_lock(UINT32_MAX);
+    lv_label_set_text(F.status, text);
+    lv_obj_clear_flag(F.status, LV_OBJ_FLAG_HIDDEN);
+    bsp_display_unlock();
+}
+
 void face_activity(void)
 {
     F.last_activity = now_ms();