hub: assemble scope and spectrum WebSocket frames

[vu2cpl]

Summary

Surfaces the LP-500 / LP-700's on-LCD scope (waveform) and spectrum (FFT)
buffers over the existing /ws endpoint as two new frame types:

{"type":"scope",    "data":{"samples":[151,151,...len=320], "channel":1, ...}}
{"type":"spectrum", "data":{"bins":[77,227,...len=320],     "channel":1, ...}}

While the meter is on the waveform or spectrum LCD page, the HID owner
interleaves a 6-tick cycle (cmd '0', then sample cmds '1'..'5')
instead of the legacy cmd '0' / cmd '6' cycle, assembles the
5 × 64-byte segments into one 320-byte buffer, and emits ~4 Hz. In
power_swr / setup modes the legacy cycle is preserved — no
overhead is paid where it isn't useful.

Why

The firmware exposes the scope and spectrum buffers via cmds '1'..'5',
but until now we ignored them — the Mac and web clients couldn't
mirror the LCD's Waveform / Spectrum pages. The wire format wasn't
publicly documented; a new probe -samples subcommand was added to
reverse-engineer it against the bench LP-700, then this change
productionises it.

The interesting design call: frame routing is by SHAPE, not write order

An earlier iteration matched each IN frame to the OUT cmd that
produced it via a FIFO. That approach desyncs on any single missed
event (stale kernel-buffered frame at HID open, an unsolicited
firmware frame on mode change) and the misalignment then cascades —
sample bytes leak into the telemetry decoder and clients see
nonsensical telemetry (swr: 20.52, peak < avg, channel /
peak_mode / top_mode flapping without commands, ASCII-leaked status
garbage). All of those were observed in production with the FIFO.

This PR uses shape-based classification instead. Three classes:

1. Echo — byte[0] in '0'..'?' AND rest zero. Firmware refused
   the OUT. Dropped.
2. Telemetry — passes isLikelyTelemetry in owner.go: byte-3
   ≤ 3 (top_mode), byte-4 ≤ 4 (channel), byte-5 ≤ 4, byte-6 ≤ 11
   (range), byte-7 ≤ 1 (alarm flag), byte-8 ≤ 2 (peak_mode), plus
   two power-coherence invariants (peak ≥ avg; SWR raw ≤ 1000).
   Random sample data passes all eight with probability < 10⁻¹².
   Decoded as a Snapshot and broadcast.
3. Sample — everything else. In waveform/spectrum mode this is
   the next segment of the 5 × 64-byte buffer; assemble in arrival
   order. A sample counter resets on every telemetry frame and on
   every top-mode change, so transient desync self-corrects within
   one cycle.

No per-write state that can desync.

Secondary fixes

• scope / spectrum emit is now gated on channel ∈ {1..4} AND
  !auto_channel. Auto-channel × waveform/spectrum is a
  hardware-invalid combination on this firmware; sample buffers in
  that state are indeterminate.
• extractStatusMessage now requires both an ASCII space and a
  3-letter run, rejecting sample-byte leakage like
  ?BFILORUY|_bfilorvy| that the prior ≥75 %-printable threshold
  let through.
• probe -samples mode_steps to power_swr before driving -channel
  / -range, since F2/F3 are no-ops on the waveform/spectrum LCD
  pages.

What's NOT in this change (deferred)

• Sample rate / time-base of the scope buffer is unknown; needs a
  CW key-up edge for timing correlation. The values render fine as
  a shape without it.
• Mac-client renderers live in VU3ESV/LP-700-App; this change is
  server-side only.
• The simulator backend doesn't synthesize scope/spectrum yet —
  clients see no frames of those types under -backend simulator.

Test plan

• go vet ./... clean
• go test -race ./... clean (new tests cover SampleReport,
  isCommandEcho, isLikelyTelemetry with the production
  leak-path frames, and extractStatusMessage rejecting
  sample-byte leakage)
• probe -samples -cycle-modes against the bench LP-700
  confirmed the 320-byte buffer is contiguous across cmds and
  that segments straddle cmd boundaries (spectrum cmd '1' tail
  0b 0b blends into cmd '2' head 0b 0b 0b 0b 0b 0b 0b)
• Cross-built linux/arm64, deployed to a live LP-700 over
  hidraw, ran a 20-second WS verify:
  - 71 telemetry frames + scope/spectrum frames
  - swr > 5: 0, peak < avg: 0, peak_mode flap: 0
  - samples / bins JSON-deserialize as list of length 320
  - Control verbs and the heartbeat still work as before

🤖 Generated with Claude Code