feat(firmware): add SD/FAT spike (Spike 3)

Standalone bench program (src/bin/sd_fat.rs, `just flash-sd`) that mounts
FAT over the EPD's shared SPI2 bus and proves the persistence module's
atomic save: write .tmp, fsync, rename, read back and compare.

Runs SD-only: the EPD's SpiBusDriver holds an exclusive bus lock for its
lifetime, so an arbitrated SD device can't be live alongside it yet. Keeps
CRC required and maps a card that rejects CMD59 to a clear "use a genuine
card" message rather than running the user's notes over an unchecked bus.

sdkconfig gains CONFIG_FATFS_LFN_HEAP (the atomic-save .tmp name isn't valid
8.3) and, temporarily, CONFIG_LOG_MAXIMUM_LEVEL_DEBUG to read the drivers'
per-command R1 bytes during bring-up.

firmware/justfile

@@ -9,6 +9,7 @@ set dotenv-load := true
 esp_env := ". ~/export-esp.sh &&"
 elf := "target/xtensa-esp32s3-espidf/release/firmware"
 elf_wifi := "target/xtensa-esp32s3-espidf/release/wifi_tls"
+elf_sd := "target/xtensa-esp32s3-espidf/release/sd_fat"
 
 # list recipes
 default:
@@ -38,6 +39,18 @@ flash-wifi:
 monitor-wifi:
     espflash monitor --elf {{elf_wifi}}
 
+# Spike 3 — build the SD/FAT spike (no .env needed)
+build-sd:
+    {{esp_env}} cargo build --release --bin sd_fat
+
+# Spike 3 — flash + monitor the SD/FAT spike
+flash-sd:
+    {{esp_env}} cargo run --release --bin sd_fat
+
+# serial monitor for the SD spike, with decoded backtraces
+monitor-sd:
+    espflash monitor --elf {{elf_sd}}
+
 # detect board, print chip/MAC/flash size
 info:
     espflash board-info