feat(ui-lvgl): roadmap stage 5 - screen PIN, live map tiles, OTA from GitHub releases

- Screen PIN (Settings > Display & power > Security): 4-8 digits in NVS,
  keypad on the lock card after every wake and on boot, 5 misses -> 30 s pause
- Live map tiles: missing tiles at the current zoom are fetched over the saved
  WiFi, written to the card and drawn; WiFi drops 30 s after leaving the map;
  "Live tiles" switch in Map tools
- Firmware update (Settings > System): checks the fork's latest release,
  streams the -ota.bin into the spare app slot over TLS verified with the
  Arduino 3.x CA bundle, checks image magic/chip id, restarts
- Release workflow publishes *_solo_lvgl envs (merged image + -ota.bin)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

solo/wio-tracker-l2/platformio.ini

@@ -36,8 +36,11 @@ lib_deps =
   ${Wio_Tracker_L2.lib_deps}
   densaugeo/base64 @ ~1.4.0
 
-; ui-lvgl skeleton: the real L2 interface -- LVGL 9 frontend over the shared UI
-; Core (docs/development/ui-core.md, step 5). Not *_solo_dual yet (no release).
+; ui-lvgl: the real L2 interface -- LVGL 9 frontend over the shared UI Core
+; (docs/development/ui-core.md, step 5). *_solo_lvgl envs are published by
+; build-solo-firmwares.yml (merged image + the -ota.bin that Settings > Firmware
+; update installs). Make the Arduino 3.x env below this one before tagging a
+; release: only 3.x builds can update themselves (CA bundle for the TLS check).
 [env:Wio_Tracker_L2_companion_solo_lvgl]
 extends = Wio_Tracker_L2
 build_flags =
@@ -57,6 +60,7 @@ build_flags =
   -D MESH_IN_PSRAM=1   ; frees ~120 KB internal RAM for WiFi/TLS map downloads
   -D PIN_BUZZER=-1     ; no piezo pin: the speaker plays through the codec
   -D BUZZER_I2S
+  -D OTA_ASSET_SUFFIX='"-Wio-Tracker-L2-ota.bin"'   ; Settings > Firmware update (Arduino 3.x builds)
 build_src_filter = ${Wio_Tracker_L2.build_src_filter}
   +<helpers/esp32/*.cpp>
   +<helpers/ui/LGFXDisplay.cpp>
@@ -92,3 +96,4 @@ lib_deps =
   HTTPClient
   NetworkClientSecure ; 3.x name of WiFiClientSecure (the header is still there)
   Preferences
+  Update              ; Settings > Firmware update