fix(usb-kbd): quiesce in-flight transfer before free; guard hot-plug leaks

Adopt the keymap crate (drops the PREV_KEYS/CAPS_USED statics for one
owned Decoder) and harden device teardown:

- #1 UAF: track REPORT_INFLIGHT (set on submit, cleared first thing in
  report_cb). Teardown moves to close_device, which pumps client events
  until the transfer quiesces before freeing it, and leaks rather than
  frees if it never does — a leak is recoverable, a use-after-free is
  not. usb_host_transfer_free's return is now checked.
- #3 leaks: a new attach while a device is still open tears the old one
  down first; control_request and start_report_polling free the transfer
  they allocated on a submit error.

Decode correctness is covered by the keymap tests; the teardown paths
are FFI and still need an on-device hot-plug run to confirm.

firmware/Cargo.toml

@@ -78,6 +78,9 @@ git = ["dep:git2"]
 [dependencies]
 anyhow = "1"
 log = "0.4"
+# Pure HID decode (Key type + edge-detecting Decoder), split out so it is
+# host-testable off the xtensa target. See ../keymap and MEMORY_AUDIT.md.
+keymap = { path = "../keymap" }
 git2 = { version = "0.20", default-features = false, optional = true }
 esp-idf-svc = { version = "0.52.1", features = ["critical-section", "embassy-time-driver", "embassy-sync"] }
 # Remove `generic-queue-8` if you plan to use `embassy-time` WITH `embassy-executor`