Add back-photo button; consolidate reset/manage onto one hold-duration button

Back button (new GPIO0, POST /frame/back): the server now tracks a
bounded history of previously-current photos (photo_queue.py), pushed
to on every advance (auto or forced) and popped by back_forced() --
symmetric with advance, so pressing next afterwards returns to right
where you were. frame_client.c's force_advance bool becomes a 3-way
fetch_action_t (NORMAL/ADVANCE/BACK) threaded through the whole fetch
path.

Also folds the separate reset and manage buttons onto one pin
(combo_button.c, replacing reset_button.c/manage_button.c entirely),
disambiguated by hold duration: quick press shows the management menu
(unchanged), ~3s hold-then-release soft-resets (esp_restart(), config
kept -- new), ~15s hold factory-resets (today's old reset behavior,
extended from 10s for clearer tier separation). Driven by a production
board (Seeed XIAO ESP32-C6) exposing only 3 of the ESP32-C6's 8
deep-sleep-wakeup-capable GPIOs -- next/back keep their own dedicated
pins where instant response matters most, everything else shares the
third pin via timing instead of needing its own. Same three-pin layout
now works on both the dev board and the production board.

Fixed a fast-tap bug in combo_button_check() before shipping: it only
did a live gpio_get_level() read to decide whether the button was
pressed at all, so a press fast enough to already be released by the
time boot reached that check was missed entirely (treated as "never
pressed" rather than "quick press"). Added the same latched
esp_sleep_get_gpio_wakeup_status() check the other buttons already use
for exactly this reason.

server/README.md

@@ -62,7 +62,17 @@ algorithm itself -- it just streams the response straight to the panel.
 - `POST /frame/advance` -- forces an immediate advance to the next photo,
   ignoring `refresh_interval_s`, and resets the interval clock from now.
   Same response shape as `/frame/image`. Used by the device's next-photo
-  button (see `firmware/README.md`).
+  button (see `firmware/README.md`). Every photo actually displayed this
+  way (or via the normal timer-based advance) is pushed onto a bounded
+  history (`app/photo_queue.py`, last 20) that `/frame/back` below can
+  return to.
+- `POST /frame/back` -- returns to the previously-current photo (the
+  exact mirror of `/frame/advance`), and resets the interval clock from
+  now. A no-op (still 200, same photo) if there's no history yet.
+  Pressing advance afterwards returns to where you were before going
+  back -- it displaces the current photo onto the front of the upcoming
+  queue rather than discarding it. Same response shape as
+  `/frame/image`. Used by the device's back-photo button.
 - `GET /frame/config` -- `{"refresh_interval_s": ...}`, polled by the frame
   each wake alongside its reachability check
 - `GET /frame/photo-info` -- `{"asset_id": ..., "location_line1": ... |