fw: robust HTTP body reads, CORS preflight, LED off at boot; update docs

- app_net.c: replace bare httpd_req_recv with recv_body_capped/alloc
  helpers (TCP-safe, full-body reads); add OPTIONS/* CORS preflight
  handler; bump WS broadcast buffer to 2048; add CORS Allow-Methods
- CMakeLists (net_service): add http_parser dep for HTTP_OPTIONS
- nfc_engine/pn532_core: add nfc_access_lock/unlock mutex, board-RGB
  quiet helper, UL type detection, general-status improvements
- pn532_transport: minor cleanup
- main.c: call board_rgb_led_quiet() at boot to kill onboard LED
- sdkconfig.defaults: add board RGB Kconfig defaults
- README, docs/LIMITATIONS, docs/PINOUT: expand and correct

Made-with: Cursor

docs/PINOUT.md

@@ -20,3 +20,13 @@ The firmware Kconfig ships **example** GPIOs:
 ## Transport selection
 
 Start with the bus your breakout is jumpered for — **I2C is often simplest** on ESP32 for bring-up; SPI may require **lower clock** initially (e.g. **100 kHz**).
+
+## Common red module switch matrix
+
+For the common Elechouse-style red PN532 board, the onboard two-position switch matrix is typically:
+
+- **HSU**: `OFF/OFF`
+- **I2C**: `ON/OFF`
+- **SPI**: `OFF/ON`
+
+Many of these boards boot in **HSU** by default, and the **I2C** and **HSU** labels often refer to the same physical header pins from opposite sides of the PCB. If the bus looks dead, check the switches before changing firmware.