Firmware: WiFi fast-connect cache (skip scan + DHCP on the next wake)

After a successful home-WiFi connection, caches BSSID/channel and
IP/netmask/gateway/DNS in NVS. The next wake's first connect attempt
uses the cached BSSID/channel (skips the all-channel scan) and applies
the cached IP directly once the link comes up (skips DHCP) -- a couple
fewer seconds of radio-on time per wake, free every wake since nothing
about the network actually needs renegotiating most of the time.

Falls back to a normal scan+DHCP attempt, and clears the cache, if: the
fast attempt itself fails, or it "succeeds" at the WiFi layer but the
full fetch cycle then fails anyway (a stale cached IP/DNS/gateway that
associates but can't actually reach the server). Also cleared on
(re)provisioning and factory reset, since a new network shouldn't try
to reuse the old one's cache.

The static-IP path needed care to get right without touching untested
territory: esp_netif_set_ip_info() only posts IP_EVENT_STA_GOT_IP (what
the existing connect-wait logic blocks on) once the netif is already
up, which the internal netif-glue's own WIFI_EVENT_STA_CONNECTED
handler guarantees by running first (registered earlier, in
esp_netif_create_default_wifi_sta()) -- confirmed against ESP-IDF's own
static_ip example and esp_netif_handlers.c source rather than assumed.
Falling back after a failed fast attempt also needed an explicit
esp_netif_dhcpc_start() first: esp_netif_dhcpc_stop() leaves the netif's
DHCP status STOPPED rather than resetting to INIT, and left alone the
glue would silently re-post the stale cached IP on the next connect
instead of actually running DHCP (esp_netif_action_connected).

Version bumped to 1.1.0 (real feature, not just a fix); build-verified
clean on both board configs (devkit 8MB, XIAO 4MB), no new warnings.

docs/architecture.md

@@ -55,8 +55,12 @@ sequenceDiagram
    The captive portal form saves SSID/password/toolsserver to NVS and
    reboots.
 2. **Stored config exists**: connect to the saved WiFi network (a few
-   retries before falling back to provisioning if it fails), then run the
-   fetch cycle in `frame_client.c`:
+   retries before falling back to provisioning if it fails). The first
+   attempt tries a cached BSSID/channel + static IP from the last
+   successful connection, skipping the scan and DHCP; a bad cache falls
+   back to a normal attempt and gets cleared (see `firmware/README.md`'s
+   "WiFi fast-connect" section). Then run the fetch cycle in
+   `frame_client.c`:
    - Check the next-photo and back-photo buttons (`next_button_check()`,
      `back_button_check()`) -- if either was what woke the device
      (checked via the latched `esp_sleep_get_gpio_wakeup_status()`, not