feat: add a screen cleaning lock for every deck

[FadyFaheem]

Wiping a touch deck fires whatever key is under the cloth. The host cannot
prevent it either, because page keys are switched by the firmware itself
without asking the desktop. This adds a cleaning lock that swallows every
touch on the panel.

Turning it on

• A key on the deck — the new Clean screen core action, next to Sleep.
• Devices — a per-board Clean screen button, plus Clean all screens
  in the header once two capable boards are connected.

Turning it off

• Hold the circle in the middle of the deck for five seconds. A bar under
  it fills as you hold, and sliding off resets it.
• Stop cleaning in Devices.

Nothing else exits: taps outside the circle, page keys, and the idle blank are
all suppressed while the lock is on.

How it works

Host sends {type:clean,active:true} and the board replies
clean-ack. The board is the source of truth — the same clean message
arrives unprompted when the five second hold releases the lock, so the desktop
follows a deck that was unlocked by hand. The board also re-announces an
active lock after a hello, so a desktop that reconnects mid-wipe does not show
a stale state.

Gated on a new clean-mode hello feature: boards on older firmware show no
control, and the key action reports that the firmware needs updating.

Firmware goes to 0.3.0 on both boards, so they need a reflash from Devices
before the feature appears.

Notes for review

• deck_ui_set_clean needs the display lock that the LVGL press callback
  already holds, so the hold is settled from deck_ui_poll and retried while
  the lock is busy.
• A profile sync landing mid-wipe stages the grid behind the lock rather than
  loading it over the overlay.
• The overlay lives in a new deck_clean.c so deck_ui.c stays under the
  component's 1000-line ceiling (913 now).

Verification

npm test (231 pass), npm run check, the board source tests, and
build-catalog.js --validate-only all pass locally. The firmware is not
compiled locally — no ESP-IDF on this machine — so Board CI is the first
real compile of the C changes.