Add two physical buttons: factory-reset and next-photo

Factory-reset (GPIO3, hold 10s): clears stored WiFi/server config and
restarts into provisioning -- the deliberate, USB-free replacement for
the earlier reverted RST-based auto-reprovisioning idea.

Next-photo (GPIO2, tap): wakes the device and forces the server to
advance immediately via a new POST /frame/advance, instead of waiting
for the refresh interval. Both buttons arm themselves as deep-sleep GPIO
wakeup sources so a press is noticed promptly even while asleep.

Also makes GET /frame/image side-effect-free: it now only advances once
refresh_interval_s has elapsed since the current photo was set (tracked
server-side), so a device reboot for any reason just redisplays the
current photo instead of silently skipping ahead. The server maintains a
small reorderable upcoming-photos queue, viewable and rearrangeable from
the web UI.

firmware/main/Kconfig.projbuild

@@ -83,4 +83,42 @@ menu "ESPresso Frame Configuration"
             server was unreachable or the fetch/display failed, instead of
             waiting the full FRAME_SLEEP_INTERVAL_S.
 
+    config FRAME_RESET_BUTTON_GPIO
+        int "Factory-reset button GPIO (-1 to disable)"
+        default 3
+        range -1 7
+        help
+            Button wired between this GPIO and GND (active-low, internal
+            pull-up enabled in firmware -- no external resistor needed).
+            Holding it for FRAME_RESET_BUTTON_HOLD_MS clears the stored
+            WiFi/server config and restarts the device into provisioning
+            mode. Must be GPIO 0-7 -- the only pins the ESP32-C6 can use as
+            an EXT1 deep-sleep wakeup source, which is what lets a press
+            wake the device promptly instead of only being noticed during
+            its brief awake windows. Set to -1 to disable the feature
+            entirely.
+
+    config FRAME_RESET_BUTTON_HOLD_MS
+        int "Factory-reset button hold duration (ms)"
+        default 10000
+        depends on FRAME_RESET_BUTTON_GPIO >= 0
+        help
+            How long the reset button must be held continuously before the
+            device clears its stored config and reboots into provisioning.
+            Long enough that it won't trigger by accident.
+
+    config FRAME_NEXT_BUTTON_GPIO
+        int "Next-photo button GPIO (-1 to disable)"
+        default 2
+        range -1 7
+        help
+            Button wired between this GPIO and GND (active-low, internal
+            pull-up enabled in firmware -- no external resistor needed).
+            Pressing it wakes the device (if asleep), forces the server to
+            advance to the next photo immediately (POST /frame/advance)
+            regardless of the configured refresh interval, and displays
+            it. Must be GPIO 0-7 for the same deep-sleep-wakeup reason as
+            FRAME_RESET_BUTTON_GPIO above; defaults to a different pin
+            than the reset button. Set to -1 to disable the feature.
+
 endmenu