Refine manage overlay: US/CAN state abbreviations, share-QR caption, and an escalating second menu with named-face labels

Two rounds of follow-up work on the manage-button overlay:

1. Location formatting: US/Canada now show abbreviated state/province
   ("CA", "ON") instead of the full name, other countries show the full
   country name, and each is its own line (was one line, now wraps to
   two) so longer international place names have more room without
   threatening to overlap the top-right QR box. The bottom-left share QR
   also gets a "SCAN TO DOWNLOAD" caption.

2. Escalating menu: pressing the manage button again while its overlay
   is already up adds a second level -- each Immich-identified person's
   name labeled next to their face in the photo (using Immich's own
   face recognition/People data, no detection/recognition added to this
   project). A third press exits immediately instead of waiting out the
   30s auto-revert timer. No new Immich API needed -- GET /api/faces
   already embeds a nullable person.name per face; new
   server/app/face_labels.py maps a named face's box into the final
   800x480 frame's pixel space (reusing crop-box math extracted from
   image_pipeline.py's face-aware cropping). Capped at 4 named faces,
   sized to a real firmware RAM budget: each label is its own malloc'd
   overlay region on the device, alongside the 4 fixed corner regions
   already in use. New GET /frame/face-labels returns a flattened
   fixed-slot JSON shape (not a real array) so firmware's existing
   flat-scalar parser can read it without needing an actual array
   parser. No persistent state needed for the escalation itself -- it's
   all local control flow within one continuous awake session
   (frame_client.c's run_management_menu()).

firmware/README.md

@@ -112,14 +112,20 @@ the photo visible and unchanged:
   link for that exact photo. The link is only created once someone
   actually scans it, and expires 30 minutes after that.
 
-After 30 seconds it automatically reverts to the plain photo. See
-`FRAME_MANAGE_BUTTON_GPIO` above to change the pin or disable the
-feature.
+After 30 seconds with no further presses it automatically reverts to the
+plain photo. Pressing the button *again* while this is up escalates to a
+second menu level -- everything above, plus the name of anyone Immich
+has identified labeled right next to their face in the photo (skipped
+for faces Immich hasn't been told a name for; no face detection happens
+on the device or the server, this is entirely Immich's own People
+feature). A third press exits immediately rather than waiting out the
+30-second timer. See `FRAME_MANAGE_BUTTON_GPIO` above to change the pin
+or disable the feature.
 
-The device stays awake for the full 30 seconds (two physical refreshes,
-one for the overlay and one to revert), so this costs meaningfully more
-power than a normal wake -- expected for a deliberate, occasional action,
-same tradeoff as the other two buttons.
+The device stays awake the whole time (up to three physical refreshes:
+the base overlay, the escalated one, and reverting), so this costs
+meaningfully more power than a normal wake -- expected for a deliberate,
+occasional action, same tradeoff as the other two buttons.
 
 ## Resetting to provisioning mode