fw: robust HTTP body reads, CORS preflight, LED off at boot; update docs

- app_net.c: replace bare httpd_req_recv with recv_body_capped/alloc
  helpers (TCP-safe, full-body reads); add OPTIONS/* CORS preflight
  handler; bump WS broadcast buffer to 2048; add CORS Allow-Methods
- CMakeLists (net_service): add http_parser dep for HTTP_OPTIONS
- nfc_engine/pn532_core: add nfc_access_lock/unlock mutex, board-RGB
  quiet helper, UL type detection, general-status improvements
- pn532_transport: minor cleanup
- main.c: call board_rgb_led_quiet() at boot to kill onboard LED
- sdkconfig.defaults: add board RGB Kconfig defaults
- README, docs/LIMITATIONS, docs/PINOUT: expand and correct

Made-with: Cursor

firmware/main/main.c

@@ -1,4 +1,5 @@
 #include "esp_log.h"
+#include "esp_ota_ops.h"
 #include "board_rgb_off.h"
 #include "nfc_engine/nfc_engine.h"
 #include "nfc_engine/session_capture.h"
@@ -8,6 +9,7 @@ static const char *TAG = "main";
 
 void app_main(void)
 {
+    (void)esp_ota_mark_app_valid_cancel_rollback();
     board_rgb_led_quiet();
     ESP_LOGI(TAG, "PN532 NFC Toolkit starting");
     ESP_ERROR_CHECK(nfc_engine_init());