feat: event-based walker detector tuned to real 7' overhead mount

Replace per-track line-crossing counter with a single event state machine
gated by foreground pixel count (ENTER=250, EXIT=150) and finalized by
quiet-exit or timeout. Direction inferred from centroid excursion
(up_score vs down_score) on quiet-exit fires, and from net displacement
(last_c vs first_c) on timeout fires.

Tuning reflects bench data at the intended 7' overhead mount: walkers
produce smaller centroid excursions than originally modelled, so
EXTENT gates, MIN_TRAJ, MAX_FRAMES and REFRACTORY were all relaxed from
their initial guesses. Constants and rationale live in firmware/lib/cv/cv.h.

Bench results (8 isolated walks, 4 entries + 4 exits):
  * Event detection: 8/8 (100%)
  * Aggregate entries+exits split: 4+4 (matches)
  * Per-walk direction labelling: 4/8 (~50%)

Document explicitly that per-walk direction is unreliable at this mount
and that downstream analytics should trust only gross traffic
(entries + exits). Recovering direction would require a physical mount
change or a richer signal; both are out of scope for v1.

Tooling:
  * tools/replay_logs.py — replay event state machine against captured
    [F] diagnostic lines, for offline tuning without flash-test loops.
  * firmware/src/main_capture.cpp + tools/capture_frames.py +
    tools/replay_frames.py — raw-frame capture firmware and Python port
    of the detector, kept in tree for future iteration even though the
    TimerCamera-F serial driver stripped specific byte ranges in testing
    and log-based replay became the working path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

firmware/platformio.ini

@@ -7,6 +7,7 @@ platform = espressif32@6.6.0
 board = m5stack-timer-cam
 framework = arduino
 board_build.partitions = partitions_4mb_ota.csv
+build_src_filter = +<*> -<main_capture.cpp>
 build_flags =
     -DBOARD_HAS_PSRAM
     -mfix-esp32-psram-cache-issue
@@ -23,6 +24,25 @@ lib_deps =
     h2zero/NimBLE-Arduino@^1.4.2
     espressif/esp32-camera
 
+; Frame-capture build. Strips WiFi/BLE/CV/reporter; streams raw 96x96 frames
+; over serial at 921600 baud for offline algorithm iteration.
+[env:timercam-capture]
+platform = espressif32@6.6.0
+board = m5stack-timer-cam
+framework = arduino
+board_build.partitions = partitions_4mb_ota.csv
+build_flags =
+    -DBOARD_HAS_PSRAM
+    -mfix-esp32-psram-cache-issue
+    -DCORE_DEBUG_LEVEL=0
+    -DCONFIG_SPIRAM_USE_MALLOC=1
+build_src_filter = -<*> +<main_capture.cpp> +<camera.cpp>
+monitor_speed = 460800
+upload_speed = 115200
+upload_flags = --no-stub
+lib_deps =
+    espressif/esp32-camera
+
 [env:native]
 platform = native
 test_framework = unity