Pr1 nodedb warmstore (#10705)

* NodeDB: 3-tier node store with persistent warm tier (long-tail identity retention)

Introduces a tiered NodeDB so the device retains identity (public key,
last_heard) for far more nodes than fit in the full-record hot store,
without growing heap or the persisted nodes.proto unboundedly.

- Hot store: full NodeInfoLite, MAX_NUM_NODES (120 on nRF52).
- Satellite maps: position/telemetry/environment/status capped at
  MAX_SATELLITE_NODES (40 freshest); eviction via enforceSatelliteCaps /
  evictSatelliteOverCap.
- Warm tier (WarmNodeStore): 40 B {num,last_heard,public_key} records for
  evicted nodes so DMs to/from long-tail nodes keep encrypting/decrypting.
  Persisted to /prefs/warm.dat, or on nRF52840 a dedicated 12 KB raw-flash
  record-ring below LittleFS (3x4 KB pages; see linker scripts + the
  nrf52_warm_region.py post-link guard).

NodeDB::getOrCreateMeshNode now demotes evicted nodes into the warm tier and
re-admits them (restoring key/last_heard). Router PKI decrypt/encode resolve
the peer key via NodeDB::copyPublicKey (hot store, then warm tier).

NodeInfoLite gains snr_q4 (sint32, Q4-encoded dB); the float snr is zeroed on
disk. NodeInfoLite grows 105 -> 112 B; backup 2432 -> 2468 B.

Note: the snr_q4 .proto change still needs to land in the protobufs submodule
(generated header is updated here; submodule pointer left at upstream).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* NodeDB: robust receive + retention for blocked (ignored) nodes

Hardens how ignored/favourite nodes are received over admin and retained,
closing paths where a block could be lost or accidentally cleared.

- Blocking keeps the node's public key (admin set_ignored_node and
  addFromContact no longer zero it / drop the warm-tier key), so a blocked
  peer stays a verifiable identity.
- set_ignored_node creates the node if absent, so a block by node ID sticks
  even for a node we've never heard from (e.g. pushed by a remote admin) with
  no NodeInfo or key.
- Eviction protection (favourite/ignored/manually-verified) now also applies to
  the load-time hot-store migration and is never undone by cleanupMeshDB, which
  previously purged ignored nodes that lacked user info.
- The hot-store migration leaves our own node (index 0) in place and prefers to
  demote non-protected nodes, like the runtime eviction scan.

Caps the protected set (favourite + ignored + verified) at MAX_NUM_NODES-2 via
NodeDB::setProtectedFlag(), so at least two evictable slots always remain and
getOrCreateMeshNode can always make room — replacing the previous unconditional
append that could run off the end of the node vector when every node was
protected. A locally-set favourite/ignore that hits the cap reports back to the
phone via a ClientNotification.

Adds test_nodedb_blocked covering the migration, favourite/ignored eviction
protection, ignored-survives-cleanup, and the protected-node cap. The
maintenance methods stay private in production; the test reaches them through a
PIO_UNIT_TESTING-guarded friend shim.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

# Conflicts:
#	src/mesh/NodeDB.h

* fix copilot comments

* once again

* WarmNodeStore: fix cppcheck warnings (uninitvar, constVariablePointer)

Zero-initialise `stranded[]` and `seqs[]/order[]` VLAs so cppcheck can
verify there are no unguarded reads of uninitialised memory (the guards
exist but are not visible to static analysis). Mark two local pointers
`const` where the pointed-to entry is never mutated after assignment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* self-care added to assist 2.7 and 2.8 nodedb migration

* Tidy warm-store/self-care: comments, guards, log + flash cleanup

Style/cleanup pass over the branch (no behavior change except the noted
preprocessor simplifications, which are semantically identical):

- Comments: move function descriptions to the headers, cap in-function
  comments at ~3-4 lines, drop leading-number step markers, label stacked
  #endif blocks, de-decorate banner comments.
- dumpToLog: fully gate decl + definition + AdminModule call site behind
  MESHTASTIC_NODEDB_MIGRATION_VERBOSE so it compiles out when disabled
  (~1.2 KB when off).
- mesh-pb-constants: drop the dead nRF52832 WARM_NODE_COUNT branch and trim
  the macro docs.
- WarmNodeStore: simplify the redundant `ARCH_NRF52 && NRF52840_XXAA` guards
  to `NRF52840_XXAA`, add a kNoPage sentinel for the ring page state.
- Shorten the always-on LOG_WARN strings (~120 B flash).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* more tidying up, aligning with docs and undoing other-arch regressions

* Update protobufs (#19)

Co-authored-by: NomDeTom <116762865+NomDeTom@users.noreply.github.com>

* made the migration pathway cleareer

* address copilot review

* fixed a copilot review on a downstream PR.

* Address Copilot review comments for PR #10705 (warmstore/nodedb)

- WarmNodeStore.h: default MIGRATION_VERBOSE to 0 (suppress info-level
  chatter on production builds; opt in with =1)
- WarmNodeStore.cpp load(): move memset to top of function so all
  failure paths (header-read fail, invalid header) leave entries clear
- WarmNodeStore.cpp save(): replace manual spiLock lock/unlock around
  mkdir with LockGuard covering the full SafeFile sequence, matching
  the lock discipline in load()
- Router.cpp: memcpy(&p->public_key.bytes, ...) -> memcpy(p->public_key.bytes,
  ...) — pass decayed uint8_t* rather than pointer-to-array
- AdminModule.cpp: check setProtectedFlag return for PKC auto-favorite;
  log cap-refusal warning instead of unconditional "auto-favoriting"
- nrf52_warm_region.py: error message references both v6.ld and v7.ld

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* NodeDB: formatting cleanup (blank lines after preprocessor blocks)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Lukewarm store

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>

src/mesh/mesh-pb-constants.h

@@ -48,39 +48,40 @@ static_assert(sizeof(meshtastic_NodeInfoLite) <= 130, "NodeInfoLite size increas
 #define MESHTASTIC_EXCLUDE_POSITIONDB 1
 #else
 #define MESHTASTIC_EXCLUDE_POSITIONDB 0
-#endif
-#endif
+#endif // STM32WL
+#endif // MESHTASTIC_EXCLUDE_POSITIONDB
 
 #ifndef MESHTASTIC_EXCLUDE_TELEMETRYDB
 #if defined(ARCH_STM32WL)
 #define MESHTASTIC_EXCLUDE_TELEMETRYDB 1
 #else
 #define MESHTASTIC_EXCLUDE_TELEMETRYDB 0
-#endif
-#endif
+#endif // STM32WL
+#endif // MESHTASTIC_EXCLUDE_TELEMETRYDB
 
 #ifndef MESHTASTIC_EXCLUDE_ENVIRONMENTDB
 #if defined(ARCH_STM32WL)
 #define MESHTASTIC_EXCLUDE_ENVIRONMENTDB 1
 #else
 #define MESHTASTIC_EXCLUDE_ENVIRONMENTDB 0
-#endif
-#endif
+#endif // STM32WL
+#endif // MESHTASTIC_EXCLUDE_ENVIRONMENTDB
 
 #ifndef MESHTASTIC_EXCLUDE_STATUSDB
 #if defined(ARCH_STM32WL) || defined(MESHTASTIC_EXCLUDE_STATUS)
 #define MESHTASTIC_EXCLUDE_STATUSDB 1
 #else
 #define MESHTASTIC_EXCLUDE_STATUSDB 0
-#endif
-#endif
+#endif // STM32WL
+#endif // MESHTASTIC_EXCLUDE_STATUSDB
 
-/// max number of nodes allowed in the nodeDB
+/// Max nodes in the hot store (full NodeInfoLite). Evicted nodes' identities
+/// live in the warm tier (WARM_NODE_COUNT). nRF52840 caps at 120 to keep
+/// nodes.proto inside the stock 28 KB LittleFS; flash-rich platforms (ESP32-S3,
+/// portduino) keep their larger hot store and lean on warm only for the tail.
 #ifndef MAX_NUM_NODES
 #if defined(ARCH_STM32WL)
 #define MAX_NUM_NODES 10
-#elif defined(ARCH_NRF52)
-#define MAX_NUM_NODES 150
 #elif defined(CONFIG_IDF_TARGET_ESP32S3)
 #include "Esp.h"
 static inline int get_max_num_nodes()
@@ -95,10 +96,43 @@ static inline int get_max_num_nodes()
     }
 }
 #define MAX_NUM_NODES get_max_num_nodes()
+#elif defined(ARCH_PORTDUINO)
+#define MAX_NUM_NODES 250 // native host: no flash/RAM constraint; match the ESP32-S3 top tier
 #else
-#define MAX_NUM_NODES 100
-#endif
-#endif
+#define MAX_NUM_NODES 120 // nRF52840 (28 KB LittleFS) and generic ESP32
+#endif                    // platform
+#endif                    // MAX_NUM_NODES
+
+/// Per-map cap (position/telemetry/environment/status): only the freshest
+/// MAX_SATELLITE_NODES nodes keep satellite payloads, the rest just the
+/// NodeInfoLite header. RAM-bound (the maps are internal-SRAM, not PSRAM), so
+/// flash-rich hosts get a cap >= their hot store (satellites for every node, as
+/// before the cap existed) while constrained parts stay at 40.
+#ifndef MAX_SATELLITE_NODES
+#if defined(CONFIG_IDF_TARGET_ESP32S3) || defined(ARCH_PORTDUINO)
+#define MAX_SATELLITE_NODES 250
+#else
+#define MAX_SATELLITE_NODES 40 // nRF52840 (28 KB LittleFS) and generic ESP32
+#endif                         // platform
+#endif                         // MAX_SATELLITE_NODES
+
+/// Warm tier: 40 B {num, last_heard, public_key} records kept for evicted nodes
+/// so DMs to/from them keep decrypting. 0 disables it; size is per-platform
+/// below, persisted to /prefs/warm.dat (or the nRF52840 raw-flash ring).
+#ifndef WARM_NODE_COUNT
+#if defined(ARCH_STM32WL)
+#define WARM_NODE_COUNT 0
+#elif defined(NRF52840_XXAA)
+// Keyed on the NRF52840_XXAA build flag, not ARCH_NRF52: the latter (from
+// architecture.h via configuration.h) isn't defined this early in every include
+// chain. Backed by the raw-flash ring below LittleFS — see WarmNodeStore.h.
+#define WARM_NODE_COUNT 200
+#elif defined(CONFIG_IDF_TARGET_ESP32S3)
+#define WARM_NODE_COUNT 2000 // PSRAM-backed when available; warm.dat ~80 KB
+#else
+#define WARM_NODE_COUNT 320
+#endif // platform
+#endif // WARM_NODE_COUNT
 
 /// Max number of channels allowed
 #define MAX_NUM_CHANNELS (member_size(meshtastic_ChannelFile, channels) / member_size(meshtastic_ChannelFile, channels[0]))
@@ -125,8 +159,8 @@ static inline int get_max_num_nodes()
 #define TRAFFIC_MANAGEMENT_CACHE_SIZE 1000
 #else
 #define TRAFFIC_MANAGEMENT_CACHE_SIZE 0
-#endif
-#endif
+#endif // HAS_TRAFFIC_MANAGEMENT
+#endif // TRAFFIC_MANAGEMENT_CACHE_SIZE
 
 /// helper function for encoding a record as a protobuf, any failures to encode are fatal and we will panic
 /// returns the encoded packet size