fix: three stack overflows crashing firmware on TimerCamera-F

loopTask: cv_init() created a CVState{} temporary (9KB background
array) on the stack — fixed by initializing members directly.

cam task: cv_process() had uint8_t fg[CV_PIXELS] (9KB) as a local
variable — made static, matching the existing fg_copy fix.

cam task stack bumped from 4096 to 8192 for headroom.

Also: switch to 4MB OTA partition table (TimerCamera-F has 4MB flash,
not 8MB), add CONFIG_ARDUINO_LOOP_STACK_SIZE=16384 build flag,
upload_speed=115200 and --no-stub for reliable CH340 flashing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

firmware/lib/cv/cv.cpp

@@ -6,8 +6,15 @@
 #include <vector>
 
 void cv_init(CVState& state) {
-    state = CVState{};   // value-initialize — calls vector default ctor correctly
-    state.next_id = 1;
+    // Initialize members directly — avoid CVState{} temporary which puts 9KB on stack
+    memset(state.background, 0, sizeof(state.background));
+    state.bg_valid          = false;
+    state.last_motion_frame = 0;
+    state.frame_index       = 0;
+    state.next_id           = 1;
+    state.tracks.clear();
+    state.entries = 0;
+    state.exits   = 0;
 }
 
 void cv_reset_counts(CVState& state) {
@@ -83,7 +90,7 @@ CVResult cv_process(CVState& state, const uint8_t* frame, uint8_t line_pct) {
         return result;
     }
 
-    uint8_t fg[CV_PIXELS];
+    static uint8_t fg[CV_PIXELS];  // static: avoids 9KB on task stack
     frame_diff(frame, state.background, fg, CV_PIXELS);
 
     int fg_count = 0;