Add back-photo button; consolidate reset/manage onto one hold-duration button

Back button (new GPIO0, POST /frame/back): the server now tracks a
bounded history of previously-current photos (photo_queue.py), pushed
to on every advance (auto or forced) and popped by back_forced() --
symmetric with advance, so pressing next afterwards returns to right
where you were. frame_client.c's force_advance bool becomes a 3-way
fetch_action_t (NORMAL/ADVANCE/BACK) threaded through the whole fetch
path.

Also folds the separate reset and manage buttons onto one pin
(combo_button.c, replacing reset_button.c/manage_button.c entirely),
disambiguated by hold duration: quick press shows the management menu
(unchanged), ~3s hold-then-release soft-resets (esp_restart(), config
kept -- new), ~15s hold factory-resets (today's old reset behavior,
extended from 10s for clearer tier separation). Driven by a production
board (Seeed XIAO ESP32-C6) exposing only 3 of the ESP32-C6's 8
deep-sleep-wakeup-capable GPIOs -- next/back keep their own dedicated
pins where instant response matters most, everything else shares the
third pin via timing instead of needing its own. Same three-pin layout
now works on both the dev board and the production board.

Fixed a fast-tap bug in combo_button_check() before shipping: it only
did a live gpio_get_level() read to decide whether the button was
pressed at all, so a press fast enough to already be released by the
time boot reached that check was missed entirely (treated as "never
pressed" rather than "quick press"). Added the same latched
esp_sleep_get_gpio_wakeup_status() check the other buttons already use
for exactly this reason.

firmware/main/combo_button.c

@@ -0,0 +1,93 @@
+#include "driver/gpio.h"
+#include "esp_log.h"
+#include "esp_sleep.h"
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+
+#include "wifi_provisioning.h"
+
+#include "combo_button.h"
+
+static const char *TAG = "combo_button";
+
+#if CONFIG_FRAME_COMBO_BUTTON_GPIO >= 0
+
+#define COMBO_BUTTON_GPIO ((gpio_num_t)CONFIG_FRAME_COMBO_BUTTON_GPIO)
+#define COMBO_BUTTON_POLL_MS 100
+
+void combo_button_init(void)
+{
+    /* See next_button.c's next_button_init() for why this has to run
+     * before gpio_config() -- a deep sleep with this pin armed as a
+     * wakeup source leaves it "held," and nothing un-holds it on wake
+     * except explicitly asking. */
+    gpio_hold_dis(COMBO_BUTTON_GPIO);
+
+    gpio_config_t io_conf = {
+        .pin_bit_mask = 1ULL << COMBO_BUTTON_GPIO,
+        .mode = GPIO_MODE_INPUT,
+        .pull_up_en = GPIO_PULLUP_ENABLE,
+    };
+    gpio_config(&io_conf);
+
+    /* See next_button.c for why this API (not ext1) -- it manages the
+     * pull resistor across the sleep transition itself, so the pin
+     * doesn't float and wake the device spuriously. */
+    esp_sleep_enable_gpio_wakeup_on_hp_periph_powerdown(1ULL << COMBO_BUTTON_GPIO, ESP_GPIO_WAKEUP_GPIO_LOW);
+}
+
+bool combo_button_check(void)
+{
+    /* A quick tap can easily release before we get here (~tens to
+     * hundreds of ms into boot, same issue the other buttons already
+     * hit and fixed -- confirmed on hardware: a fast press was being
+     * missed entirely with just a live level check here). The wakeup
+     * status register is latched at the moment of waking and isn't
+     * cleared until the next sleep entry, so it still confirms this pin
+     * caused the wake even if it's since been released -- in which case
+     * the poll loop below simply measures 0ms held, correctly resolving
+     * to a quick press rather than "not pressed at all." */
+    bool caused_wake = esp_sleep_get_gpio_wakeup_status() & (1ULL << COMBO_BUTTON_GPIO);
+    if (!caused_wake && gpio_get_level(COMBO_BUTTON_GPIO) != 0) {
+        return false; /* not pressed, and didn't cause this wake either */
+    }
+
+    ESP_LOGI(TAG, "Combo button held -- quick press for menu, %dms for soft reset, %dms for factory reset",
+             CONFIG_FRAME_COMBO_SOFT_RESET_HOLD_MS, CONFIG_FRAME_COMBO_FACTORY_RESET_HOLD_MS);
+
+    int elapsed_ms = 0;
+    while (gpio_get_level(COMBO_BUTTON_GPIO) == 0) {
+        vTaskDelay(pdMS_TO_TICKS(COMBO_BUTTON_POLL_MS));
+        elapsed_ms += COMBO_BUTTON_POLL_MS;
+        if (elapsed_ms >= CONFIG_FRAME_COMBO_FACTORY_RESET_HOLD_MS) {
+            /* Fires immediately, doesn't wait for release -- same
+             * convention as the old dedicated reset button. */
+            ESP_LOGW(TAG, "Held %dms, clearing config and restarting into provisioning",
+                     CONFIG_FRAME_COMBO_FACTORY_RESET_HOLD_MS);
+            frame_config_clear();
+            esp_restart();
+        }
+    }
+
+    if (elapsed_ms >= CONFIG_FRAME_COMBO_SOFT_RESET_HOLD_MS) {
+        ESP_LOGW(TAG, "Held %dms and released, soft-restarting (config kept)", elapsed_ms);
+        esp_restart();
+    }
+
+    ESP_LOGI(TAG, "Quick press (%dms), showing management menu", elapsed_ms);
+    return true;
+}
+
+bool combo_button_is_pressed(void)
+{
+    return gpio_get_level(COMBO_BUTTON_GPIO) == 0;
+}
+
+#else
+
+void combo_button_init(void) {}
+bool combo_button_check(void) { return false; }
+bool combo_button_is_pressed(void) { return false; }
+
+#endif