feat(reporter): apply server-pushed CV tuning from heartbeat response

Heartbeat POST now captures the response body (up to 2048 bytes) and
looks for a "config" object. If cfg_version advances past the stored
value and all tunable fields pass range validation, the new tuning is
applied to g_cv and persisted to NVS.

- cv_tuning_validate: pure range checker (cv.cpp)
- cv_apply_tuning / cv_get_tuning: mutex-guarded helpers in main.cpp
  exposed via cv_apply.h; 500 ms timeout, drop on contention
- post_json now returns int (HTTP status) and optionally captures the
  response body; existing callers check == 200
- heartbeat: parse → cfg_version check → override present fields →
  validate → apply → save. Silent no-op when server returns no config.
- 3 new native tests (15/15 pass). timercam flash 1,423,897 bytes
  (+9,828 vs baseline).

firmware/lib/cv/cv.h

@@ -43,3 +43,7 @@ struct CVResult {
 void cv_init(CVState& state);
 CVResult cv_process(CVState& state, const uint8_t* frame);
 void cv_reset_counts(CVState& state);
+
+// Pure validator: returns true iff all tunable fields are in range and
+// cfg_version is non-zero. No Arduino deps — safe for native tests.
+bool cv_tuning_validate(const CVTuning& t);