fix: HMAC module — mbedTLS error handling, hex guard, test docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

firmware/test/test_native/test_hmac.cpp

@@ -5,6 +5,13 @@
 void setUp(void) {}
 void tearDown(void) {}
 
+// Expected value derived via:
+// import hmac, hashlib
+// secret = bytes.fromhex("0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20")
+// body = '{"location_id":"retailer-123","records":[]}'
+// body_hash = hashlib.sha256(body.encode()).hexdigest()
+// msg = f"dc-0042:1712000000:{body_hash}"
+// hmac.new(secret, msg.encode(), hashlib.sha256).hexdigest()
 void test_hmac_known_vector() {
     HString secret = "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20";
     HString device = "dc-0042";