[codex] Add app catalog refresh cache

[n30nex]

Summary

• Adds a service-level app catalog refresh path: fetch bounded JSON, validate it, then atomically cache it.
• Adds serial app catalog fetch <url>, app catalog refresh <url>, and app catalog clear diagnostics.
• Aligns firmware catalog validation with the documented limitlezz.app.catalog.v1 schema, including package_* fields, compatibility targets, HTTPS URLs, lowercase SHA-256, and screenshot metadata objects.
• Makes app catalog status prefer the refreshed cache before legacy catalog/index.json files.

Validation

• python scripts\validate_app_catalog.py docs\examples\app-catalog-index.json
• python scripts\validate_local_app_samples.py
• git diff --check
• pio run -e native
• .pio\build\native\program.exe --selftest
• .pio\build\native\program.exe --simtest
• GitHub Actions Firmware CI: https://github.com/ItsLimitlezz/LimitlezzOS/actions/runs/27872425009

Hardware Evidence

• Target: COM8 only, ESP32-S3 VID_303A/PID_1001, MAC cc:8d:a2:0d:14:28.
• Artifact: tdeck-firmware-7d8a8c71562efff6b1d898513dc3dae543bae6cd from run 27872425009.
• Manifest: budget_status=pass, firmware_bytes=1715392, static_ram_bytes=235256.
• Flash: PlatformIO packaged esptool.py on COM8 with --no-stub, all hashes verified.
• Serial smoke: id, sys, app catalog test, app catalog clear, app catalog status, invalid app catalog fetch ftp://..., and HTTPS fetch while Wi-Fi offline completed with smoke PASS.
• Observed catalog results: selftest PASS valid=2 invalid_error="bad sha256"; clear returned [ok]; status returned app catalog: no cached index; invalid URL returned bad url; HTTPS fetch returned wifi offline as expected without Wi-Fi.

Notes

• This PR does not add package download/install/update yet. It establishes the trusted metadata refresh/cache path those flows need.
• Production catalog source pinning/TLS verification remains a follow-up; the current T-Deck HTTPS transport uses the existing insecure client mode before broad release hardening.