feat: add native tinySA spectrum analyzer backend

[AlCalzone]

Summary

• Add a native tinySA backend that publishes calibrated dBm traces directly. It never synthesizes IQ or calls process_block.
• Support the spectrum, waterfall, marker, band-plan and wide-sweep surfaces. Layouts that require IQ samples, ADC data, demodulation, RF-chain modelling or stream timing are hidden.
• Add USB CDC discovery, explicit serial paths and model handling for basic tinySA, ZS405, ZS406 and ZS407 devices.
• Add device options for point count, RBW, attenuation, LNA, LNA2, AGC, spur handling and external-gain correction.

Protocol

A dedicated worker owns the serial port. Startup aborts stale scans, verifies version and info, queries the configured zero level and forces analyzer input mode. Acquisition uses counted scanraw START STOP POINTS 1 frames with signed little-endian levels. Scan deadlines follow span, RBW, point count and spur settings. Basic and Ultra devices switch RF input paths at their model-specific boundaries.

Hardware verification

The backend was tested on a tinySA Ultra ZS405 running tinySA4_v1.4-236-ge5aa115. The live checks covered discovery, normal and Ultra RF paths, spectrum frames, native wide sweeps, cancellation, point changes and LNA/attenuation coupling. The device was disconnected before the final upstream-main rebase, so the rebased integration was validated through the automated checks below.

Validation

• 1,294 library-free tests pass.
• 1,304 tests pass with both native backend cfgs enabled.
• Clippy passes with warnings denied, apart from the existing collapsible_match allowance.
• Rust 1.88 cargo check --all-targets passes.
• cargo package --locked passes.

This implements the frame-based backend discussed in #5.

[AlCalzone]

Converting to draft, until I'm happy with it.

[AlCalzone]

Superseded by a focused PR stack starting with #7. The concrete tinySA backend and follow-up features will be submitted as dependent draft PRs.