fix(bot,ui): defer bot actions past throttle, fix CardKB lock bypass, add !gps fix timeout arg

- Bot Actions (!buzz/!gps/!advert/!gpio1-4) ran their side effect
  immediately during botScanCommands(), before quiet-hours/cooldown/
  per-contact throttle were checked -- those gates only suppressed the
  reply text, not the actual buzz/GPS toggle/advert/pin write. botCommandReply()
  now only records what was requested; applyPendingBotActions() runs the
  deferred effects once a wrapper's throttle checks pass and the ack sent,
  mirroring the existing _locfix_requested pattern. resetPendingBotActions()
  clears everything on every throttled/aborted path.

- CardKB's Fn+<letter> accent-popup shortcut bypassed the locked-input gate
  (it called into KeyboardWidget directly instead of through the
  enqueueKey()/dequeue path every other key uses, so it wasn't discarded
  while _locked). Now checks _locked itself.

- Since a locked device now correctly ignores CardKB entirely, Fn+Esc
  (single press) is added as CardKB's own lock/unlock gesture -- otherwise
  a CardKB-only setup had no way to unlock. Esc rather than the adjacent
  Fn+Backspace, to avoid an accidental press.

- botScanCommands() now parses up to two arguments per command instead of
  one. Used by "!gps fix [seconds]" to override the default 90s timeout
  (clamped 15-300s) for a poor sky view where 90s isn't always enough to
  reach isLocFixReady()'s HDOP/satellite bar.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/companion_radio/MyMesh.h

@@ -328,7 +328,7 @@ private:
   bool tryBotCommand(const ContactInfo& from, const char* text, uint8_t hops);          // DM commands
   bool tryBotChannelCommand(uint8_t channel_idx, const char* text, uint8_t hops);       // channel commands
   bool tryBotRoomCommand(const ContactInfo& from, const uint8_t* sender_prefix, const char* text, uint8_t hops); // room commands
-  bool botCommandReply(const char* cmd, const char* arg, bool actions_allowed, uint8_t hops, uint32_t ts, char* out, int out_len, const char* sender_name);  // one command → reply text
+  bool botCommandReply(const char* cmd, const char* arg, const char* arg2, bool actions_allowed, uint8_t hops, uint32_t ts, char* out, int out_len, const char* sender_name);  // one command → reply text
   int  botScanCommands(const char* body, uint8_t hops, uint32_t ts, char* out, int out_len, const char* sender_name, bool actions_allowed); // scan "!word"s → combined reply, returns count
   // !gps fix -- single-shot "wait for a stabilised GPS fix, then push a follow-up
   // message" action. botCommandReply() only sets _locfix_requested (it doesn't know
@@ -465,6 +465,26 @@ private:
   PendingLocFix _loc_fix;
   bool _locfix_requested;   // transient: set by botCommandReply() when "!gps fix" was
                             // seen this scan, cleared by the tryBot*Command() wrapper
+  uint32_t _locfix_requested_timeout_ms;  // "!gps fix [seconds]" override, see startLocFix()
+
+  // Deferred bot actions (!gps on|off, !buzz, !advert, !gpio1..4 on|off) --
+  // botCommandReply() only records what was requested; the actual hardware/
+  // radio side effect happens in applyPendingBotActions(), called by the
+  // tryBot*Command() wrappers only once quiet-hours/cooldown/per-contact
+  // throttle have passed and the ack actually sent. Otherwise those gates
+  // would only suppress the reply text while the action fired unconditionally
+  // on every matching message (e.g. !buzz still buzzing during quiet hours,
+  // or an unthrottled !advert flooding the mesh). Mirrors the _locfix_requested
+  // pattern above; resetPendingBotActions() is the throttled/aborted-path
+  // twin of applyPendingBotActions(), used wherever _locfix_requested used to
+  // be cleared alone.
+  bool _bot_gps_action_pending;
+  bool _bot_gps_action_on;
+  int  _bot_buzz_action_secs;    // 0 = no !buzz requested this scan
+  bool _bot_advert_action_pending;
+  int8_t _bot_gpio_action[4];    // per pin: -1 none requested, 0 off, 1 on
+  void applyPendingBotActions();
+  void resetPendingBotActions();
 
   TransportKey send_scope;