fix(screenshot): drop C-style cast UB, fix ERR check order

handleScreenshotRequest() reinterpret-cast every DisplayDriver* first to
SH1106Display* then to SSD1306Display*; both casts always produce a
non-null pointer, so the SSD1306 fallback was unreachable and on any
SSD1306 build we called SH1106::getBuffer() on a SSD1306 object — UB
that only happened to work because both backing classes share an
Adafruit_GFX layout at offset zero.

Replace the cast hack with virtual getBuffer()/getBufferSize() on
DisplayDriver, overridden in SH1106Display and SSD1306Display. MyMesh
no longer needs to know about either concrete type. const-correct the
buffer pointer and widen bufferSize to uint16_t while passing through.

Also fix the matching Python decoder: it sanity-checked length before
dispatching on resp_code, so a 2-byte RESP_CODE_ERR frame was reported
as "Frame too short" instead of the actual device error. Move the
length check after the resp_code dispatch and log the error code byte.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/helpers/ui/SSD1306Display.h

@@ -47,7 +47,7 @@ public:
   void endFrame() override;
   
 #ifdef ENABLE_SCREENSHOT
-  // Screenshot support
-  uint8_t* getBuffer() { return display.getBuffer(); }
+  const uint8_t* getBuffer()     override { return display.getBuffer(); }
+  uint16_t       getBufferSize() override { return (uint16_t)((width() * height()) / 8); }
 #endif
 };