fix: review fixes for the shades.cfg records

- A group in a backup from before version 23 has no rolling code, and a
  restore wrote 0 to NVS for it.  It keeps the code NVS has.
- A restore reads each record into one that starts as the shade, group
  or settings it replaces, so what an older version lacks stays as it
  was (the update check below version 20 among them), as before.
- restoreFile and loadFile read the rooms, shades and groups through one
  readModel(); the settings, network and radio are applied by helpers.
- The shade's tilt is forgotten where the shades are written, not in the
  conversion to a record.
- rollingCodeAfterLoad moves to RollingCode.h and its tests to
  test_rollingcode.
- The topics a deleted shade or group clears are one list each
  (MqttTopics.h), tested against what is published.
- e2e: a restore of the shades brings back every shade and group, and
  the README has the rollback check by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/README.md

@@ -21,4 +21,11 @@ A plain run sends nothing on air, changes no setting (it saves only values the d
 
 The web UI holds one of the device's 5 socket slots for each open tab, and Home Assistant holds one. The tests that fill every slot fill the ones left, so close the UI's tabs for the full load.
 
+A rollback is checked by hand, on a release build with an OTA slot:
+
+1. Note the version the web UI shows.
+2. Build firmware that restarts before it is marked good: add `abort();` at the end of `setup()` in `src/SomfyController.cpp`, and change `data-src/appversion` so the two versions differ.
+3. Update to it through the web UI, with the serial monitor open.
+4. The crash restarts the device, and the bootloader boots the old firmware ([ADR 0003](../../docs/adr/0003-pioarduino-idf55.md)). The web UI shows the version from step 1 again.
+
 The tests run in whatever security mode the device is in; the suite never changes it. To test both modes, run the suite once in each.

test/e2e/test_restore.py

@@ -91,3 +91,22 @@ def test_a_restore_of_the_radio_alone_brings_it_back_as_it_was(request, host, to
     wait_for_restart(host, token, schema, booted)
     c, _, _ = synced_model(connect, schema)
     assert settings(c, schema, "radio") == radio
+
+
+def test_a_restore_of_the_shades_brings_them_back_as_they_were(request, host, token, connect, schema):
+    """Every shade and group, their rolling codes included, from a backup taken a moment before."""
+    if not request.config.getoption("--reboot"):
+        pytest.skip("restores a backup and reboots the device: pass --reboot")
+    _, shades, groups = synced_model(connect, schema)
+    _, frames, _ = run_sync(connect(schema=schema.hash))
+    booted = boot_time(schema, frames)
+    status, _, backup = http(host, "/backup", headers=auth(token))
+    assert status == 200
+
+    options = json.dumps({"shades": True})
+    status, _, body = upload(host, "/restore", auth(token), file=backup, fields={"data": options})
+    assert status == 200, body
+    wait_for_restart(host, token, schema, booted)
+    _, shades_after, groups_after = synced_model(connect, schema)
+    assert shades_after == shades
+    assert groups_after == groups

test/e2e/test_update.py

@@ -3,6 +3,10 @@
 Pass --firmware with a firmware.bin built for the device's chip, e.g.
 .pio/build/esp32s3/firmware.bin.  The device must have an OTA slot: the
 release builds do, the C5, C6 and debug builds don't.
+
+It can't tell the new firmware from the old when both have the same
+version, and it doesn't make the update fail.  test/e2e/README.md has the
+rollback check by hand.
 """
 import time